summaryrefslogtreecommitdiffstats
path: root/assets/keytransition-2010-09-19.txt
blob: 66953e07f0585370e53d507a246779739db91a2e (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Sun Sep 19 21:26:48 CEST 2010

For a number of reasons, i've recently set up a new OpenPGP key, and
will be transitioning away from my old one.

The old key is revoked and i prefer all future correspondence to come
to the new one.  I would also like this new key to be re-integrated
into the web of trust. This message is signed by both keys to certify
the transition. Furthermore, I signed the new key with the old key to
strengthen the new key's trust.

the old key was:

pub   1024D/1038A449 2007-07-02 [revoked: 2010-09-19]
      Key fingerprint = 5C25 2AEE 48ED ABF0 B367  D54C C6A9 C74E 1038 A449

And the new key is:

pub   4096R/6320D802 2010-09-19 [expires: 2012-09-18]
      Key fingerprint = 4AA8 D7AE B560 E43C 7A57  661E F471 199B 6320 D802

To fetch the full key you can get it with:

  wget -q -O- http://scrit.ch/gpg.txt | gpg --import -

Or, to fetch my new key from a public key server, you can simply do:

  gpg --keyserver keys.immerda.ch --recv-key 6320D802

If you already know my old key, you can now verify that the new key is
signed by the old one:

  gpg --check-sigs 6320D802

If you don't already know my old key, or you just want to be double
extra paranoid, you can check the fingerprint against the one above:

  gpg --fingerprint 6320D802

If you are satisfied that you've got the right key, and the UIDs match
what you expect, I'd appreciate it if you would sign my key:

  gpg --sign-key 6320D802

Lastly, if you could upload these signatures, i would appreciate it.
You can either send me an e-mail with the new signatures (if you have
a functional MTA on your system):

  gpg --armor --export 6320D802 | mail -s 'OpenPGP Signatures' mh@scrit.ch

Or you can just upload the signatures to a public keyserver directly:

  gpg --keyserver zimmermann.mayfirst.org --send-key 6320D802

Please let me know if there is any trouble, and sorry for the
inconvenience.

Regards,

  Marcel Haerry
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iQIcBAEBAgAGBQJMlmrQAAoJEPRxGZtjINgCD94P/269OolOcfsWdxpx2k0iwkMt
9TQxrqdcWSVX+2BBMbrSFnLSLflUzZ5voqnjbSinQtn/bqVbSTc79bRvBJKNEtUE
G/F7+ANGDwXys848Hrd8w5UlhPGuo5MFGusgaX1+jkgo7VQ092EHyuZhsky3i99z
r/kgNCp5x6stSLnpsgoJzlQw3tcHlQsiDz7p83SwrbkJfAaGQNUN75yTmvZylaPK
gu/d99AzOCz9JcZzKmzv9h5smwW2AAg4rvIXf5zRJ0LCWptQhCYmTJfcAEo/Rnde
JfFztJnbgWNjw8fCQPE+IVUdPnGaX5JVdXT1kIH5yZm5rYMPo8232eQMQ9Hw/lZf
qT/Ulr5CSTI9ArSErFsvnVIUdZLTxNgrKUOPKd6LURzEiHtt+Bk4pJWF8gdS51F4
FpMtWRe2993xN21178+co3a51HrX0YXZfCVDsHIT3lIr3Lce2R+BWTgCgJ36Vp2S
S+8cDX4XekYECpbvEHrwypz/86HiKtTPO0/jVOApu9nOsg+SN8ycr+iWSU8d/IVF
gBUbpCbQOr2huiQrTXmYrMCrkNW/iFGYSP4Z/kbLt7HW4pYw5mcBuXpxsauYdn7k
rQ6kTPBJyir54U1uE43a44GNfak/Nc8zHnof3M4AhBQ3oW1y4nC1k2SqFfUNmRVo
qdOn1F098q3rs/0+HefiiEYEARECAAYFAkyWatAACgkQxqnHThA4pEnRLwCdGWNr
4mUVy0PqVUR8AYx1/19+om8An1ExBODsRoiZOff3Dgh34FA/caOl
=+/VI
-----END PGP SIGNATURE-----