Re: Update of James Bottemley's key in the kernel PGP keyring

On Wed, 2026-01-28 at 08:38 -0500, Konstantin Ryabitsev wrote:
> On Wed, Jan 28, 2026 at 08:30:31AM -0500, James Bottomley wrote:
[...]
> > Well isn't that why this whole web of trust signature deprecation
> > thing is wrong.  The question, as Linus put it in that email, is
> > *not* does it work now, but did it work then.  And since we have
> > the date of the signature we can know it was signed before sha1 was
> > deemed compromised and thus can't be a forgery of Linus' indication
> > of trust in me. And since it's already embedded in a transparency
> > log (git in this case) that date can be proven.
> 
> The hard part is tooling -- I'm all for everyone simply re-signing
> all of their previous signatures that are done with sha1. In fact, in
> my view this should be a mostly automated process, but it isn't and
> doing it manually is a huge time sink. Happy to be proven wrong here.

Well, what you say you want to do can actually be done without
resigning.  You simply adjust the trustdb (set ultimate for the current
anchors and full for all the others) and whatever tool you're using for
the graphs should "just work" (provided it pays attention to trustdb).
Of course, this is local to you.  Exporting a trustdb for others to use
gets really messy but if you did it under a shared key that's used just
for keys.kernel.org that might work.

Regards,

James