-
-
Notifications
You must be signed in to change notification settings - Fork 77
Description
Is your feature request related to a problem? Please describe.
The text regarding the encryption key states:
This field indicates an encryption key that security researchers should use for encrypted communication. Keys MUST NOT appear in this field - instead the value of this field MUST be a URI pointing to a location where the key can be retrieved. If this field indicates a web URI, then it MUST begin with "https://" (as per section 2.7.2 of {{!RFC7230}}).
There are examples utilising OpenPGP, however it is not described if other forms of encryption are allowed. OpenPGP is specifically RECOMMENDED in section 3.3 however that only applies to signing the file itself.
Describe the solution you'd like
I believe acceptable keys should be clarified. Posting a key for a proprietary product for example would defeat the purpose of this open standard.
I further suggest those acceptable formats should include the new (https://github.com/FiloSottile/age)[Age]. Aside from offering a modern encryption solution, the small key sizes may introduce the option of including the entire encryption key right there on the encryption line. Example for myself:
Encryption: age public key: age16nwklgjs6mdagl7w7pa5898urtkay68mkrgzhnstaacgtr4ldcrqzssru7
Note Age does not do signing and this suggestion does not need to impact section 3.3.
Describe alternatives you've considered
Limiting to OpenPGP would be the alternative.