Re: Web of Trust work [Was: kernel.org tooling update]

[James Bottomley <James.Bottomley@HansenPartnership.com>]

On Fri, 2026-01-23 at 13:23 -0500, Konstantin Ryabitsev wrote[...]
>   - We're limited to PGP only, but it would be nice to also support
> something like fido2 ssh key signatures.

Just trying to understand what you mean here: the FIDO2 ssh
implementation is really nothing more than a key that provides a
signature created by the token.  In fact FIDO2 keys are pretty similar
to TPM keys in that they can either be token resident or stored as
files (which are wrapped so only the token can decrypt them) and loaded
into the token for signature.  Unlike a TPM, FIDO 2 is a bit more
algorithm poor (most only support P256 although some of the later
devices do 25519) but the elliptic curve algorithms they do support are
sufficient for gpg to use them.  The huge downside of FIDO2 is that
unlike a TPM it can't import keys, so this means every key would be
newly created.  However, it could still be used by gpg for newly
created signing and encryption subkeys (you'd have to keep your master
key as a keyfile unless you want to create a new master key).

I do know how to plumb this into gpg, because it would be the same
places at TPM support went.  However, realistically, without the
ability to import existing keys, it would provide a less easy (and
likely less secure, given you need your master key to sign other keys)
experience than just using the existing gpg TPM2 support, so why not
simply use that?

Regards,

James