Hacker News new | past | comments | ask | show | jobs | submit login

Here is an example of how to change the email address associated with a OpenPGP identity on a key server:

* https://coderwall.com/p/tx_1-g/gpg-change-email-for-key-in-p...

If you want to invalidate the identity entirely you just upload the revocation certificate.




I don't think you understand: the key is not mine, it's from the previous users of that domain, so I can't apply these instructions as I don't have their private keys!

To make things worse, there is no mechanism to let the key server know that the emails associated with these keys are invalid.

And I have tried my best to get in touch with maintainers to explain the stupidity of this situation, but there is apparently no way besides revocation certificates to deprecate or delete a key. Or, if I give a less generous interpretation, maybe they want to keep pretending that PGP still has a lot of users?

So a known bad key is associated with my domain, with no way to fix that - except maybe waiting for PGP key servers to die and be finally replaced by something better.

This is why I call that an outdated technology. I'm sure it was good 30 years ago, but it should have evolved.




Consider applying for YC's Fall 2025 batch! Applications are open till Aug 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: