Re: PGP keysigning event at Apachecon

[Shane Curcuru <sh...@yahoo.com>]

+1 to an 'officially' announced (i.e. in the program somewhere, even if at 
an odd time) key signing party.

---- sander@temme.net ----
 > We could do that, but I have no problems receiving the mails. I could keep
 > the growing key list in the committers module so every committer can add
 > their own key. This way we also keep track of what happens to the file.

This is a good start, although you might also want to talk on community@ 
about an all-ASF-committers-available KEYS file (which is what this sounds 
like).  I know httpd has a pretty thorough group-wide KEYS file with strong 
signatures, but I didn't think we had (yet) gotten an ASF-wide KEYS file - 
either for official use (i.e. one that we might export publicly, or refer 
to from download pages, etc.) or unofficial use (for convenience of 
committers).

And good point about the fact that some committers might not want to sign 
keys; privacy is still important (although not helpful for web-of-trust 
issues).

Here's a side question that's partly beyond the bounds of this mailing 
list: I'm pretty sure the ASF does not have it's own 'corporate' key; does 
'ApacheCon' have one? (Whatever exact organizational structure 'ApacheCon' 
has other than the ASF committee and the travel/security/organizing 
contractors)

- Shane