Nick Szabo  🔑

Interesting problem: Build verifyable chain from PGP-signed git commit to each end user browser. Anyone working on that? @keonne @blockchain

Take trusted JS browser code execution to the next level. If "binaries" have moved to the browser, code there must be signed.

SSL is woefully inadequate against large classes of MITM. Chain from PGP-signed git commit (etc.) to browser much more secure.

@jgarzik To make PGP better, need also a reliance statement: ie you rely on PGP to say what, exactly? Not MITM'd? Not malware? Not private?

@iang_fc @jgarzik This signing, SSL or PGP, would provide integrity of the channel from the signed code to browser -- no more than that.

@iang_fc @jgarzik Previous schemes "failed" because we added expectations crypto doesn't actually provide, e.g. "identity" of source.

@NickSzabo4 @jgarzik users are rational, expect to rely on claims from "crypto". Without reliance, what's the point? What are we saying?

@iang_fc @jgarzik SSH is good model. Leave judging of "identity" & non-crypto integrity, which is dependent on local knowledge, up to users.