It's an attempt to solve the key distribution problem. By having you verify your keys on third party sites, a MITM or NSL attack (providing you with fake keys so your messages can be intercepted) gets a lot harder as you have to attack n sites simultaneously instead of one.
Comments
Found out about this today, you can prepend any GitHub username with .keys to fetch their public keys.
What can this be used for? I'd love to display my GPG key there instead but I guess that's not possible.
Have you seen https://keybase.io/ that's an ideal place for your GPG keys (and more) :-)
I can't tell if it's finished yet:
Nor do I understand why I'd use it. Do lots of people post GPG encrypted messages to each other on gist?
It's an attempt to solve the key distribution problem. By having you verify your keys on third party sites, a MITM or NSL attack (providing you with fake keys so your messages can be intercepted) gets a lot harder as you have to attack n sites simultaneously instead of one.
as an alternative to ssh-copy-id ?
Yepp, and there is already an existing tool, which currently supports GitHub as well as Launchpad.
http://manpages.ubuntu.com/manpages/trusty/en/man1/ssh-impor... https://launchpad.net/ssh-import-id
you mean you can append any GitHub username