<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><blockquote class="gmail_quote" style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: small; margin: 0px 0px 0px 0.8ex; border-left-width: 1px; border-left-color: rgb(204, 204, 204); border-left-style: solid; padding-left: 1ex; background-color: rgb(255, 255, 255);">(2) We need a new protocol that allows a sender to advertise to the<br class="">recipient what their key is and that they prefer encrypted email. The<br class="">email signature is a good signal, but not ideal because there is no real<br class="">binding between the fingerprint on the signature and the email address<br class=""></blockquote><div style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: small; background-color: rgb(255, 255, 255);" class=""><br class=""></div><div style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: small; background-color: rgb(255, 255, 255);" class="">I hate to sound like a broken record, but if you decided not to encrypt all mails by default but rather trigger it off a signed message .... then you have the S/MIME model and your above problem only exists due to the insistence on using PGP. </div><div style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: small; background-color: rgb(255, 255, 255);" class=""><br class=""></div><div style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: small; background-color: rgb(255, 255, 255);" class="">Otherwise, the signature contains the certificate which contains a cryptographic binding between email address and key.</div><div style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: small; background-color: rgb(255, 255, 255);" class=""><br class=""></div><div style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: small; background-color: rgb(255, 255, 255);" class="">What's more - existing mail clients already have the behaviour you're asking for! There is no work to do!</div><div style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: small; background-color: rgb(255, 255, 255);" class=""><br class=""></div><div style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: small; background-color: rgb(255, 255, 255);" class="">If you want to try it out, <a href="https://www.comodo.com/home/email-security/free-email-certificate.php" style="color: rgb(17, 85, 204);" class="">grab a free cert here</a> and send me a mail signed with it. I'll reply back with a signed+encrypted message. If your mail client can see this email then you should be able to send me an encrypted mail immediately, assuming the list manager doesn’t scramble the MIME.</div><div style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: small; background-color: rgb(255, 255, 255);" class=""> </div><blockquote class="gmail_quote" style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: small; margin: 0px 0px 0px 0.8ex; border-left-width: 1px; border-left-color: rgb(204, 204, 204); border-left-style: solid; padding-left: 1ex; background-color: rgb(255, 255, 255);">A universal system of key validation would obviate the need for this, but<br class="">until we all agree on a single standard...<br class=""></blockquote><div style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: small; background-color: rgb(255, 255, 255);" class=""><br class=""></div><div style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: small; background-color: rgb(255, 255, 255);" class="">There <i class="">is</i> a standard for all the things you are asking for. It is specified by the IETF. It has protocols for verified key transitions and more. It's widely deployed and implemented. It's just not PGP.</div><div style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: small; background-color: rgb(255, 255, 255);" class=""><br class=""></div></body></html>