-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


Julian T. J. Midgley: Use of GPG/PGP
===================================

I have two GPG keys of significance, one of which I use for signing
other people's keys, and the other of which is used for what I term
"casual correspondence".  Both keys are available from the public
keyservers.

The two keys are:

Main key:

pub  1024D/BCC7863F 2001-03-01 Julian T. J. Midgley <jtjm@xenoclast.org>
Key fingerprint = 52D9 1750 5721 7E58 C9E1  A7D5 3027 2F2E BCC7 863F
sub  1024g/FA723CFD 2001-03-01

Casual correspondence key:

pub  1024D/16C42365 2002-11-01 Julian T. J. Midgley 
(casual correspondence key) <jtjm_gpg@xenoclast.org>
Key fingerprint = 7695 F0A9 C4AF 6D24 B79E  F334 3D21 EEE2 16C4 2365
sub  1024g/3A47171A 2002-11-01


The two keys have separate purposes, and are used as follows:


Main Key (BCC7863F)
- -------------------

1.  I only ever ask people to sign the main key, and will
    only ever sign other people's keys with that key.  The Main Key is
    kept securely offline, and may be used to encrypt important
    messages to me.  

2.  I will use the Main Key for signing documents of importance, and
    for such purposes as signing any software that I release from my
    website.


Casual Correspondence Key (16C42365)
- ------------------------------------

1.  The casual correspondence key (16C42365) is kept on a machine
    which is permanently connected to the Internet.  This machine is
    secured as carefully as possible, but by virtue of its network
    connection, the risk of this key being compromised is
    significantly greater than that of the main key.  It is used for
    what I term "casual correspondence" - primarily for signing and
    receiving encrypted emails where there is benefit to be obtained
    from the use of cryptography, but where the information concerned
    is not sufficiently sensitive that it warrants use of the main
    key. 

    The casual correspondence key should be used to encrypt messsages
    to me that contain information that you would have been happy to
    send to me by first-class post in an ordinary sealed envelope, but
    would not have wanted to send to me written on the back of a post
    card.

    Conversely, information that you would only otherwise have
    disclosed to me in person, or sent to me by trusted courier,
    should be encrypted with the Main Key.

    I use the casual correspondence key to sign files that had they
    been printed on paper, I would merely have signed by hand - if you
    receive such a file you can be pretty confident that I actually
    signed it, but there is a small possibility that it's a forgery
    (the same situation as arises if you receive a letter from me
    signed in ink).  I use the Main Key to sign files that I want to
    provide a more robust assurance were created/verified/whatever by
    me; it's used in the same circumstances that a signature witnessed
    by one or more other people would be required, and comes with a
    similar assurance of validity.

2.  Under NO CIRCUMSTANCES WHATSOEVER will I sign someone else's key
    with the casual correspondence key (16C42365).  If anyone should
    discover a key that has been signed by the casual correspondence
    key (other than itself), this will be a sure sign that the key has
    been compromised, and I should be grateful if they would contact
    me immediately so that I can revoke it.  When you import the
    casual correspondence key onto your key ring, you should /always/
    assume that it cannot be trusted as a signator of other people's
    keys (regardless of its validity on your key ring): assign a trust
    value of '2' - 'I do not trust'.


3.  The casual correspondence key is signed by the Main Key.  So there
    should always exist a valid trust path to the casual key from the
    Main Key (being the one that collects other people's signatures).
    No PGP/GPG key other than one signed by the Main Key is to be
    considered a valid key for communicating with me, unless the Main
    Key itself has been revoked (in which case I will create a new
    Main Key and a new casual correspondence key, and this notice
    will be upgraded with details of the new keys).


Revocation
- ----------

Should I ever have to revoke either of the keys, I will always be
happy to supply my reason for doing so, except where prohibited by law
under the RIP Act.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iD8DBQE9wv56MCcvLrzHhj8RAlgXAJ4qogboE+QIRE7Kjtnt83HBFjtsrACfXyeO
mTPUQMf9hkZvKJ1zivMCPtQ=
=H+vm
-----END PGP SIGNATURE-----