/lookup sometime returns bad signatures on vector.im

[babolivier]

When looking up the MXID for an email I registered some time ago ([email protected], on 22/08/2018), and trying to validate the signature that Sydent returns in the response, I get Signature was forged or corrupt. The public key used to verify is ta8IQ0u1sp44HVpxYi7dFOdS/bfwDjcy4xLFlfY5KOA, which is the one currently shown when querying https://vector.im/_matrix/identity/api/v1/pubkey/ed25519:0.

I can reproduce this issue with all of my some-months-old 3PIDs, but if I register a new email address ([email protected], registered today around 2PM BST), the signature is correct.

[babolivier]

After investigation it seems that this was caused by bad key management on vector.im, so this is not a Sydent bug.

[richvdh]

Also: this is only a problem on the deprecated /_matrix/identity/api/v1/lookup API. The replacement /_matrix/identity/v2/lookup doesn't use a signature, so is unaffected.