erjiaqing
It feels like we don't need to assume that key leakage is a problem. If the key is leaked, the entire signature can be forged, not just the timestamp. Also, protecting the key is the user's responsibility, not the developer's. If the key is leaked, the first thing to do is revoke it immediately.
The timestamp doesn't seem like a particularly important thing, it just needs to be included in the OpenPGP signature. Compared to SSHSIG, I prefer using the OpenPGP system because it has built-in key expiration times and a trust chain mechanism, which can achieve some of the functions of a CA. Of course, you can also use SSL standards to do this. However, SSHSIG seems to lack some key control mechanisms and is not easy to migrate to hardware keys.
However, the demo was still quite impressive.
闽ICP备2021006864号-7
闽公网安备35020602002794号