Extend the OpenPGP key alias definition to cover validity of signatures
Categories
(MailNews Core :: Security: OpenPGP, enhancement)
Tracking
(Not tracked)
People
(Reporter: KaiE, Unassigned)
References
Details
Today, the feature introduced in bug 1644085 (https://wiki.mozilla.org/Thunderbird:OpenPGP:Aliases) only covers sending of encrypted email.
We received a request that an enterprise admin would like to automatically configure user systems, to cause signatures from certain OpenPGP keys to be shown as good signatures.
Given that we use the alias mechanism to automatically treat OpenPGP as accepted for encryption, it could be equally fine to accept configured keys for producing good signatures.
The existing alias mechanism is flexible, it allows multiple keys per email address. Also it allows aliases for whole domains. I think we shouldn't apply the full scope of those definitions for signatures.
However, we could extend the allowed syntax for that file, and allow defining signature validity keys.
I think we should use separate rules for encryption and signatures separate for flexibility. Maybe email to department@enterprise.com needs to be sent and encrypted to multiple users, but only one key might be valid for officially sending/signing emails in its name.
So, for email aliases, we could allow an additional category "accept-signatures" that also can define fingerprints.
Description
•