Re: [PATCH v3 2/9] ssh signing: add documentation

Fabian Stelzer [off-list ref] writes:

quoted

quoted

+gpg.ssh.keyring::
...

maybe keeeping the name "allowedSignersFile" like its called in the
ssh manpage will make this clearer without needing a lot of extra
explanation?

Yup, that sounds like an excellent way to present this to our users.

SSH has nothing compared to the gpg trust levels. Your key is either
in the allowed signers file or it is not. However even if it is not in
the file then the signature might still be "Good" but has no matching 
principal to it. To be able to differentiate the two "Good" cases i
used the existing gpg trust levels. This way if you set
gpg.mintrustlevel = fully then the signatures with no matching key in
the allowed signers file will fail to verify. Otherwise they will
verify but show a message that no principal matched with this key.

Sounds sensible.  Our task is to make sure that readers (not me, who
have already been spoon-fed the answer by you just now) would reach
the above understanding by just reading what we put in the
documentation.

Thanks.