Verifying Public Key Ownership

[christiansmith]

There are several conditions in which it may be necessary or desirable to verify public key ownership. For example:

1. a key must be bound to a specific identity to be valid
2. a key is obtained from a party other than it's originator
3. ownership of a key is asserted and must be demonstrated
4. ownership of a key is denied and must be proven

Traditionally, these problems are solved by X.509 certificates in PEM format. It's possible to modernize this technique by wrapping JWK representations of public keys in JWTs, with signatures of the appropriate parties.

Alternately, "blockchain" has been proposed by various parties as a tool for key dissemination and verification.

During the course of this demo project, we should examine various techniques, demonstrate effective strategies for verification, and outline flawed approaches, if discovered.