Allowed signers

What it is

The OpenSSH allowed_signers file. It names the member key and Dalton's key. It is not a signature.

Why it exists

ssh-keygen -Y verify only accepts a signature from a key named in this file, and only for that principal and namespace. The member key is principal member. Dalton's key is principal dalton.

How to verify

Download this file as allowed_signers. It is the -f argument in both checks. It is not checked on its own. You also need the token and the signature you are checking.

Open this from a sealed card to download the file for that member.

Member

curl -fsS -o mr.token TOKEN_URL
curl -fsS -o mr.token.sig MEMBER_SIG_URL
curl -fsS -o allowed_signers ALLOWED_SIGNERS_URL
ssh-keygen -Y verify -f allowed_signers -I member -n easyeasy-mr@easyeasyspeakeasy.com -s mr.token.sig < mr.token

Dalton

curl -fsS -o mr.token TOKEN_URL
curl -fsS -o witness.sig WITNESS_SIG_URL
curl -fsS -o allowed_signers ALLOWED_SIGNERS_URL
ssh-keygen -Y verify -f allowed_signers -I dalton -n easyeasy-mr-witness@easyeasyspeakeasy.com -s witness.sig < mr.token

Dalton's key in this file is the house signet: https://door.easyeasyspeakeasy.com/.well-known/easyeasy-mr-witness

All four checks for this card

The other pieces

Generic how-to: How the digital seal works