{"action":"created","issue":{"url":"https://api.github.com/repos/freedomofpress/securedrop/issues/3942","repository_url":"https://api.github.com/repos/freedomofpress/securedrop","labels_url":"https://api.github.com/repos/freedomofpress/securedrop/issues/3942/labels{/name}","comments_url":"https://api.github.com/repos/freedomofpress/securedrop/issues/3942/comments","events_url":"https://api.github.com/repos/freedomofpress/securedrop/issues/3942/events","html_url":"https://github.com/freedomofpress/securedrop/issues/3942","id":384043349,"node_id":"MDU6SXNzdWUzODQwNDMzNDk=","number":3942,"title":"Release Signing key should be cross-signed ","user":{"login":"jonathancross","id":5115470,"node_id":"MDQ6VXNlcjUxMTU0NzA=","avatar_url":"https://avatars3.githubusercontent.com/u/5115470?v=4","gravatar_id":"","url":"https://api.github.com/users/jonathancross","html_url":"https://github.com/jonathancross","followers_url":"https://api.github.com/users/jonathancross/followers","following_url":"https://api.github.com/users/jonathancross/following{/other_user}","gists_url":"https://api.github.com/users/jonathancross/gists{/gist_id}","starred_url":"https://api.github.com/users/jonathancross/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jonathancross/subscriptions","organizations_url":"https://api.github.com/users/jonathancross/orgs","repos_url":"https://api.github.com/users/jonathancross/repos","events_url":"https://api.github.com/users/jonathancross/events{/privacy}","received_events_url":"https://api.github.com/users/jonathancross/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-11-25T03:22:30Z","updated_at":"2018-11-25T03:34:17Z","closed_at":null,"author_association":"NONE","body":"## Description\r\n\r\nThe Release Signing key (`310F 5612 00F4 AD77`) should be coss-signed by members of the PGP Web Of Trust \"Strong Set\".  This will allow users to [establish a trust path](https://pgp.cs.uu.nl/mk_path.cgi?FROM=c0c076132ffa7695&TO=310F561200F4AD77&PATHS=trust+paths) to the key.\r\n\r\nIdeally, this key should also be cross-signed by other relevant keys such as the \"SecureDrop Team\" key  (`82BD 6C96 16DA BB79`) and developers, eg:\r\n* @conorsch  `6FB4762D12E4CDFB`\r\n* @redshiftzero `B07E80656ACD9501`\r\n* @heartsucker `C0A2586F09D77C82` (expired)\r\n\r\n@heartsucker has signed all keys except `82BD6C9616DABB79`, however none have cross-signed his key back.\r\n\r\n## User Stories\r\n\r\nBritney wants to verify a SecureDrop release without trusting keys found on websites.  She does not know a developer in person, or she is concerned about identifying herself to devs.  Therefore she needs another means to identify the correct signing key."},"comment":{"url":"https://api.github.com/repos/freedomofpress/securedrop/issues/comments/441412762","html_url":"https://github.com/freedomofpress/securedrop/issues/3942#issuecomment-441412762","issue_url":"https://api.github.com/repos/freedomofpress/securedrop/issues/3942","id":441412762,"node_id":"MDEyOklzc3VlQ29tbWVudDQ0MTQxMjc2Mg==","user":{"login":"jonathancross","id":5115470,"node_id":"MDQ6VXNlcjUxMTU0NzA=","avatar_url":"https://avatars3.githubusercontent.com/u/5115470?v=4","gravatar_id":"","url":"https://api.github.com/users/jonathancross","html_url":"https://github.com/jonathancross","followers_url":"https://api.github.com/users/jonathancross/followers","following_url":"https://api.github.com/users/jonathancross/following{/other_user}","gists_url":"https://api.github.com/users/jonathancross/gists{/gist_id}","starred_url":"https://api.github.com/users/jonathancross/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jonathancross/subscriptions","organizations_url":"https://api.github.com/users/jonathancross/orgs","repos_url":"https://api.github.com/users/jonathancross/repos","events_url":"https://api.github.com/users/jonathancross/events{/privacy}","received_events_url":"https://api.github.com/users/jonathancross/received_events","type":"User","site_admin":false},"created_at":"2018-11-25T03:34:17Z","updated_at":"2018-11-25T03:34:17Z","author_association":"NONE","body":"**PS:** I will be traveling to San Francisco in January and Berlin later this year.  Would love to have keysigning sessions with anyone interested (my key is hooked into the _strong set_)."}}
{"actor":{"display_login":"jonathancross"}}