Re: Update of James Bottemley's key in the kernel PGP keyring

On Wed, Jan 28, 2026 at 08:30:31AM -0500, James Bottomley wrote:
> > Note however that for the model that is actually implemented it's
> > Linus' signatures that matter.
> 
> Actually, it's not just Linus.  We have about five trust anchors in the
> kernel.org keyring (also not reflected in the web of trust).

Yes and no -- all top anchors had direct signatures from Linus, so it actually
worked out nicely to trace everything to the topmost anchor.

> Well isn't that why this whole web of trust signature deprecation thing
> is wrong.  The question, as Linus put it in that email, is *not* does
> it work now, but did it work then.  And since we have the date of the
> signature we can know it was signed before sha1 was deemed compromised
> and thus can't be a forgery of Linus' indication of trust in me.  And
> since it's already embedded in a transparency log (git in this case)
> that date can be proven.

The hard part is tooling -- I'm all for everyone simply re-signing all of
their previous signatures that are done with sha1. In fact, in my view this
should be a mostly automated process, but it isn't and doing it manually is a
huge time sink. Happy to be proven wrong here.

-K