<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Did you know you can locate gpg keys from DNS itself? It is a bit
sad DNS specialized group does not publish it that way. Especially
when they already have the domain signed and they could publish
the OPENPGPKEY record there.</p>
<p>gpg --auto-key-locate dane --locate-external-keys
<a class="moz-txt-link-abbreviated" href="mailto:george@nlnetlabs.nl">george@nlnetlabs.nl</a></p>
<p>It is possible also for SMIME key, in case PGP is not desired
anymore.</p>
<p>Fedora publishes its keys using dane, but not WKD.</p>
<p>Petr</p>
<div class="moz-cite-prefix">On 25/10/2025 02:21, Phil Pennock via
Unbound-users wrote:<span style="white-space: pre-wrap">
</span></div>
<blockquote type="cite"
cite="mid:aPwYJaCM1bRPGUA1@fullerene.field.pennock-tech.net">
<pre wrap="" class="moz-quote-pre">For myself, the announcement 4 days earlier (on the 20th) in the email
with Subject of "Unbound release - introducing extra PGP key" was quite
helpful.
Eg: <a class="moz-txt-link-freetext" href="https://lists.nlnetlabs.nl/pipermail/unbound-users/2025-October/008598.html">https://lists.nlnetlabs.nl/pipermail/unbound-users/2025-October/008598.html</a>
A single keyring for "all keys valid for this product" would be helpful,
albeit too often I'd see folks fetch it just before fetching the
software release assets and verify against the key just retrieved from
the same place and then be confused as to why I'd flag it as an issue.
So it's not as simple as "put it in the same place" and needs very
careful messaging to at least try to discourage people from mistakes.
As to the <a class="moz-txt-link-rfc2396E" href="https://nlnetlabs.nl/people/"><https://nlnetlabs.nl/people/></a> page, Yorgos' key is one of
only three where the key is distributed from a site under their
administrative control instead of the public swamps, so one of only
three which doesn't make me wince. This is a definite improvement.
(If PGP weren't dying such that I'm reluctant to spend effort on
advocacy any more, I'd nudge towards WKD, as used by kernel.org,
debian.org, archlinux.org, etc, so that `gpg --locate-external-keys
<a class="moz-txt-link-abbreviated" href="mailto:foo@nlnetlabs.nl">foo@nlnetlabs.nl</a>` could work; as it is, I'll leave it as this note that
a world which is simpler for relying parties is possible, if folks are
interested.)
-Phil
</pre>
</blockquote>
<pre class="moz-signature" cols="72">--
Petr Menšík
Senior Software Engineer, RHEL
Red Hat, <a class="moz-txt-link-freetext" href="https://www.redhat.com/">https://www.redhat.com/</a>
PGP: DFCF908DB7C87E8E529925BC4931CA5B6C9FC5CB</pre>
</body>
</html>