For most individuals seeking to establish a long term durable personal keychain they want others to be able to externally trust and verify easily, I would suggest the following, which is more or less what most people in my circles do:

1. Buy a smartcard with touch support such as a Nitrokey 3

2. Ideally buy 3+ backup smartcards at the same time

3. Use Keyfork on AirgapOS booted on a laptop you trust to generate a 24 word mnemonic and split-encrypt it to 3+ smartcards (or write down mnemonic on paper if you lack budget for 3 extra smartcards)

4. If using backup smartcard set, split them up across 3 secure locations, or if using a raw mnemonic put on durable storage such as cryptosteel, and put that in tamper evident storage such as in a vacuum sealed bag with confetti with pictures you have copies of elsewhere.

5. Use keyfork to derive a PGP key and load it into your smartcard

6. Setup forced/locked "touch" requirement policies on all "slots" on your card so you must tap for each use (malware cannot do this, but easy for you to do)

7. Publish public key to keys.ogenpgp.org

8. Publish public key on your own domain name using Web Key Discovery

9. Use keyoxide docs to establish keyoxide profile with every internet platform you control attesting your key fingerprint is yours to make it easy for others form confidence that all of those are you, and your key is yours.

10. Major bonus: use QubesOS and map your smartcard only to an offline vault VM that prompts you for each use, and which security domain on your system wants to use your key, so malware is unlikely to be able to trick you even if your development environment is compromised.

From there you can use your provisioned smartcard with an openpgp smartcard capable ssh agent on your workstation for git signing, git push, ssh to servers, password management with password store, signing artifacts, thunderbird for email encryption, etc.

We plan on writing up a lot more public documentation for this sort of thing as the public docs suck, but we have helped thousands of people with this sort of thing.

Pop into #!:matrix.org or #keyfork:matrix.org if you want any help or advice for specific use cases.

A partially complete set of docs for different threat models is in progress at https://trove.distrust.co

This is a very bad thing, because it is not in fact the case that there is one cryptosystem equally suited to all these tasks.

That you chose OpenSSL as your corroborating example is especially funny, because there is exactly one thing that OpenSSL is actually well-suited to doing (setting up TLS sessions), and then 20+ years of people getting themselves into grave trouble trying to get that library to do other things.

What do you want to shift the entire software supply chain security foundation of the internet to use instead and how?

Complaining the existing solution is not good enough is easy. Making things better and educating on current best efforts without creating centralized points of trust is hard.

Update

It looks like you drastically edited your comment after I replied to it, in ways that change the meaning of your prompt. That makes it impossible for us to continue discussing anything.

Oh THAT is why you are steering people away from OpenPGP, gotchu. I have read it a long time ago. I remain to be convinced. The blog post just reeks of "I can't use it, too complex for me therefore it sucks". Yeah, it can be misused, I do not deny that.

(BTW I could not care less about e-mail.)

In fact, I said "The blog post just reeks of "I can't use it, too complex for me therefore it sucks"".

I do not know if you have written it or not, if you were the one, then yeah.

Just to name some of the most common use cases I have:

1. When people in my orgs want to encrypt sensitive information to me, e.g in encrypted password databases over git.

2. When prospective new clients or security researchers want to encrypt sensitive requests to me via email. Have some in my inbox right now from today.

3. When people want to verify that commits or code reviews I signed on security critical software were really signed by me, and not masquerade malicious code as mine in a rebase, etc.

4. When people want to verify that public reproducible builds of artifacts I maintained are built by multiple maintainers.

These use cases all rely on a well published set of public keys shared with the public in ways with sufficient history and signatures so no one can impersonate me or other maintainers, or make it possible to easily trick people to encrypting data to keys that are not really ours.

I sign 100% of my commits, and 100% of all artifacts I maintain etc. Anyone claiming to be me on anything important without signatures from my very well established and easy to verify public keys, are not me.

A PGP key is the only standardized cryptographic passport for the internet and if you don't attach your work to an easily verifiable key you are one compromised account away from having your online identity used for supply chain attacks.

All major linux distributions and the core infrastructure on the internet is anchored in the PGP keys of few thousand people that put in the work to maintain well published keychains.

The only alternatives anyone have proposed are use Fulcio and let Google sign everything for you as a single point of failure for the internet. Hard pass.

Meanwhile with solutions like keyoxide, anyone can form confidence my key is mine trivially without relying on a central party:

https://keyoxide.org/6B61ECD76088748C70590D55E90A401336C8AAA...

I think this rather gives the game away.

For people for whom PGP is important, their PGP key is their identity. And there is a community of people like this. But it's small--I'd guesstimate maybe a million people or so at best, a true rounding error in terms of the internet.

For most people, however, their online identity is generally tied around one of a few core providers. The de facto identity for open source is GitHub, for better or worse. Do I like that we've moved to centralized identity management? Not particularly. But it is telling that in the shift towards identity management as a concept (e.g., OAuth2) in the past decade, PGP hasn't played a factor.

And in all of your passionate defenses of PGP, where you've complained that things don't support the PGP identity model, you've never really addressed the issues that a) most people don't have a PGP identity, b) PGP identity doesn't provide any practical value over existing identities, or c) things already work well enough with other identity models, that PGP identities don't integrate well with.

But to your point, not nearly enough people have a concept of a desire to want digital sovereignty. Ownership of their own identity in a way a company has no control of.

And the ones curious about this concept, find the barrier to explore it impossibly high. That is why I have been so convinced in recent years that UX and social dynamics matter in cryptography as much as the math behind it.

That is why we put so much thought into keyfork. We realized it has to be one or two commands tops to be up and running with a new keychain or no one is going to do it.

You see all sorts of different variants of this argument. People cling to PGP because they believe SMTP email needs a future. What does that have to do with protecting the life of a user? Nothing. People cling to PGP because of concerns about open source. Same issue. Not wanting to run things on their phone. Same issue.

The version in the Arch repos does not include the impersonate feature.

Surely you understand the difference between sometimes and all the other times? This is a game changer for all those other times. Otherwise helix has a similar extending selection mode like visual

Is it though? I honestly don't understand what the big deal is. The original contention was that the benefit was in offering selection-then-action, unlike Vi. And then when it's pointed out that Vim actually offers selection-then-action as well, there is a new assertion that it's the particular WAY that Helix offers selection-then-action that is key.

To my mind, selection-then-action is provided by Vim if you want it. Maybe it's a few extra keystrokes sometimes, because it's not the default mode, as it is in Helix, but the main concept (ability to think in object-then-verb) is available in both, if that's the way you prefer to think.

Honestly, you't not even trying to

> To my mind, selection-then-action is provided by Vim if you want it.

Ok, let your mind be content with ignoring the difference that I've just explained. By the way, you can also trivialize vim as "it's just a fewer keystrokes sometimes to do the same as in notepad, what's the big deal?"

Why do you think that? I've been listening to what you say. But again, you haven't exactly proven that operating on the single-most-recent movement (which as I understand it, also defines the selection) is the thing that you want to operate on the most often, rather than the convenience of being able to use the flexibility of multiple movements to define a selection.

Anyway, many people do claim that an editor isn't the most important thing, and that thinking takes a lot more time than the operation itself, and that therefore Notepad would often be sufficient. What those people don't really appreciate is the ability to operate on multiple lines at once, not a single selection, but across vast swathes of the text being edited. When your thinking is done, and needs to be applied to every single line of the file, you'd much rather have Vim than Notepad. But in such a case Helix wouldn't offer much, if any, advantage over Vim.

You seem emotionally attached to this in a way that my skepticism provokes, so we can drop the debate. People should use whatever they prefer; no harm done.

So I was going to write a commiseration and a screed about what a colossal UI failure this is, that you can so easily lose such work. But FWIW, before posting I searched to see if there are any extensions to address this. There are several for Chrome, but on Firefox I ended up trying "Textarea Cache", and sure enough if you close the page, and reopen it later, you can click the icon to recover your words.

There's really no reason to believe intelligence is tied to being human. Most of us accept the possibility (even the likelihood) of intelligent life in the universe, that isn't.

>human intelligence as something detached from human biology.

I don't completely agree with the previous comment, but there is something to be considered to their statement.

Given that, the constant drumbeat of pointing out how AI fails to be human, misses the mark. A lot of the same people who are making such assertions, haven't really thought about how they would quickly accept alien intelligence as legitimate and full-fledged... even though it too lacks any humanity backing it.

And why are they so eager to discount the possibility of synthetic life, and its intelligence, as mere imitation? As a poor substitute for the "real thing"? When faced with their easy acceptance of alien intelligence, it suggests that there is in fact a psychological reason at the base of this position, rather than pure rational dismissal. A desire to leave the purely logical and mechanical, and imbue our humanity with an essential spirit or soul, that maybe an alien could have, but never a machine. Ultimately, it is a religious objection, not a scientific one.

It has been proven that a Turning Machine and Lambda Calculus have the exact same equivalent expressiveness, that encompasses the _entire set_ of computable functions. Why are you so sure that "text prediction" is not equally expressive?

Was Hellen Keller not intelligent because she lacked the ability to see or hear? Is intelligence defined by a particular set of sense organs? A particular way of interacting with the environment? What about paraplegics, are they disqualified from being considered intelligent because they lack the same embodied experience as others?

Whenever you give someone kudos for being brilliant, it is always for their ability to successfully compute something. If that isn't what we're discussing when we're talking about intelligence, then what are we discussing?

On the other hand, you are clearly stating that intelligence is computation. But you're right, it would be too easy to ask you to define what any of those words mean AND to back that claim.