consider local key exchange mechanisms (geysigning, safeslinger)
The geysigning project, which reuses (and improves on!) parts of the Monkeysign code, introduces a novel idea of not depending on the keyservers to fetch the public key material before signing. To quote their README file:
In contrast to caff or monkeysign, this tool enables you to sign a key without contacting a key server. It downloads an authenticated copy of the key from the other party. For now, the key is authenticated by its fingerprint which is securely transferred via a QR code. Alternatively, the user may type the fingerprint manually, assuming that it has been transferred securely via the audible channel.
I haven't figured out exactly how the key material is copied - it is presumably done through some Avahi protocol?
OpenKeychain has its own way of doing those transfers, which are implemented as a multi-party "keysigning party" protocol of some sort. It uses an app called SafeSligner for which there is a Python library we could reuse as well.
List of possible implementations:
- [geysigning][geysigning project] - homegrown avahi + httpserver
- [SafeSlinger][] - custom protocol?
- FlyWeb - standardized web-based avahi + httpserver?