alt Hacker NewsI think the problem is this type of attestation is hard to weigh as a trust signal, vs the cloud CI version.
Inherently, if someone steals your key, or gains access to a box that can use that key for signing, they are indistinguishable from you. Hand PGP signing also lacks time-bound signing, any ratchet mechanism, CT log, consistent key hierarchy, or standard to bind signer name and project identity.
> this type of attestation is hard to weigh as a trust signal, vs the cloud CI version
In the sense that I'm not a large corporation and nobody else is auditing my personal computer, yes, that's true. Note, though, that large corporations are also subject to nefarious actors misusing their infrastructure. What if a rogue employee hacks their internal system? Or Russia or China manages to get a backdoor into it?
In any case, all this doesn't make the method I described impossible. It just means that attestations produced by an individual workflow need to be clearly labeled to distinguish them from attestations produced using a tech forge's workflow, so people will understand what, specifically, is being attested to. Then people could weigh each trust signal as they choose.
> Hand PGP signing
To be clear, I wasn't talking specifically about this method of signing with a personal key. I agree there are lots of issues with PGP as an overall system. I was only talking about the general idea of having some way for individuals to independently generate an attestation without having to go through a tech forge's workflow.