Key Signing Policy for Andrés J. Díaz
http://ajdiaz/gpg/policy.txt
Version: 2010-08-10

Preamble

This policy is valid for all signatures made by the following GnuPG keys:

pub   rsa8192/82A850A8 2013-11-12
      Key fingerprint = 0997 80BF B724 2408 DDF4  0357 7761 9F23 82A8 50A8
uid       [ultimate] Andrés Julián Díaz López (Andrés J. Díaz)
uid       [ultimate] [jpeg image of size 5138]
sub   rsa8192/A62DA9D7 2013-11-12
sub   rsa8192/7E24F965 2015-03-12


pub   rsa8192/0x9B36D1B64EB7AC4B 2015-06-16 [C]
      Key fingerprint = 887A 897F DF96 1BDF B53F  9306 9B36 D1B6 4EB7 AC4B
      Keygrip = 3B80E076D51EF8BAB28985788BB753EC0D997275
uid                 [ultimate] Andrés Julián Díaz López
uid                 [ultimate] [jpeg image of size 5138]
sub   rsa8192/0xEAF18A813F78989F 2015-06-16 [SE] [expires: 2020-06-14]
      Keygrip = 5ACD92CCC52D831230069D78C1F0447685350613


These keys will always be available on this page, but the most current
versions can usually be fetched from keyserver keys.connectical.com or
any other of the sks-keyservers.net public network.

This policy was originally written on 2010-08-10 and will be followed
from this date on but it may be replaced with a new version at any time.
Content and structure of this document are strongly based on the
OpenPGP Key Signing Policy of Marc Mutz, Jörgen Cederlöf ones and
Marcus Frings but have been slightly modified from the original sources.

Location

I live in Barcelona (Spain) and I am open to sign keys at any time. The
easiest way for verifying keys would be to meet me here. Another
opportunity to get in personal contact would be to address me at certain
computer related fairs.

Prerequisites for signing

    - The signee (the key owner who wishes to obtain a signature to
      his/her key from me, the signer) must make his/her OpenPGP key
      available on a publicly accessible keyserver (see above for example
      keyservers).
    - The signee must prove his/her identity to me by way of a valid
      identity card or driving licence. These documents must feature a
      photographic picture of the signee. No other kind of documents will
      be accepted. This also implies that the signee’s key must feature
      his/her real name in order to be checked up on his/her identity
      card. A key which only contains a pseudonym will not be signed.
    - For people from outside the European Union I will check both of
      these two tokens (since I cannot assess their risk of fraud).
      Exceptions may be made if there is a good reason for me to do so.

The signee should have prepared a strip of paper with a printout of the
output:

gpg --fingerprint 0x12345678

Or an equivalent command if the signee does not use GnuPG, where
0x12345678 is the key ID of the key which is to be signed.

A handwritten piece of paper featuring the fingerprint and all UIDs the
signee wants me to sign will also be accepted.

The above must take place under reasonable circumstances (i.e. ourselves
not being in a hurry, exchanging key data at a calm place and so on).

The act of signing

After having received (or exchanged) the proof detailed in the above I
will sign the signee’s piece of paper myself to avoid fraud.

At home I will sign the UIDs which I was asked to sign. Each signature
will then be mailed separately to the corresponding mail address of the
single UIDs.

Depending on the character of the key which is to be signed by me I
will use different levels of signatures.

Levels of signatures

- Level 3
	A level of 3 is given to sign-and-encrypt keys: I have met the signee,
	I have verified his/her identity card and fingerprint and I was able
	to send my signatures encrypted with the corresponding key of the
	signee. These signatures are the strongest in my web of trust.
	Photographic UIDs are also going to be signed with a level of 3 if I
	can still remember the signee’s face when I will be back at home.

- Level 2
	A level of 2 is given to sign-only keys. It is not clear to determine
	if the owner of the mail account is the same as the key owner because
	encryption cannot be used, hence the signatures only receive a lower
	level of 2.

- Level 1
	A level of 1 will never be used by me for it weakens the web of trust
	in my opinion. I have never signed keys without appropriate verification
	and I will never do so in the future.

- Level 0
	A level of 0 is given to keys of Certification Authorities since in
	most cases the key owner is a whole organization and not a single
	person. Usually the fingerprints of those keys have to be verified by
	getting them from the corresponding website of the CA and cannot be
	checked by exchange with a member of the CA who is in charge. These
	signatures are the weakest in my web of trust.