Received-SPF: pass (sog-mx-3.v43.ch3.sourceforge.com: domain of petertodd.org
	designates 62.13.148.110 as permitted sender)
	client-ip=62.13.148.110; envelope-from=pete@petertodd.org;
	helo=outmail148110.authsmtp.com; 
Date: Sun, 14 Sep 2014 07:28:27 +0100
From: Peter Todd <pete@petertodd.org>
To: Jeff Garzik <jgarzik@bitpay.com>
Message-ID: <20140914062826.GB21586@muck>
References: <20140913135528.GC6333@muck>
	<CAJHLa0MaE3Ki5Hs4Tu4dQNBW-EL-857N2kf-fVxYcXM6OO-84w@mail.gmail.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha256;
	protocol="application/pgp-signature"; boundary="zx4FCpZtqtKETZ7O"
Content-Disposition: inline
In-Reply-To: <CAJHLa0MaE3Ki5Hs4Tu4dQNBW-EL-857N2kf-fVxYcXM6OO-84w@mail.gmail.com>
User-Agent: Mutt/1.5.21 (2010-09-15)
Cc: Bitcoin Dev <bitcoin-development@lists.sourceforge.net>
Subject: Re: [Bitcoin-development] Does anyone have anything at all signed
 by Satoshi's PGP key?
Precedence: list


--zx4FCpZtqtKETZ7O
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Sat, Sep 13, 2014 at 10:03:20AM -0400, Jeff Garzik wrote:
> That claim is horse manure :)  He never signed private emails sent to
> me, nor the forum posts.

That's consistent with what everyone else is saying:
https://twitter.com/petertoddbtc/status/509614729879642113

> He -might- have signed the occasional thing related to releases, I'm not =
sure.

Doesn't seem like there's any evidence of that either. For instance the
archive.org Jan 31st 2009 capture of bitcoin.org with v1.3 has a link to
his PGP key, but the release itself is unsigned:
https://web.archive.org/web/20090131115053/http://bitcoin.org/

Similarly the Nov 29 2009 capture of the sourceforge download directory
has releases v0.1.0, v0.1.2, v0.1.3, and v0.1.5, none of which have
signatures:

https://web.archive.org/web/20091129231630/http://sourceforge.net/projects/=
bitcoin/files/Bitcoin/

The earliest signature I can find is from v0.3.20 from Gavin Andresen:

https://web.archive.org/web/20110502125522/http://sourceforge.net/projects/=
bitcoin/files/Bitcoin/bitcoin-0.3.20/

Earliest sig in the git commit history is the v0.3.21 tag, again from
Gavin.


My best guess is Satoshi only created the PGP key in case
someone needed to send him a security-related bug report. Which leads to
a related question:

Do we have any evidence Satoshi ever even had access to that key? Did he
ever use PGP at all for anything?

--=20
'peter'[:-1]@petertodd.org
00000000000000000ce4f740fb700bb8a9ed859ac96ac9871567a20fca07f76a

--zx4FCpZtqtKETZ7O
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature

-----BEGIN PGP SIGNATURE-----

iQGrBAEBCACVBQJUFTWGXhSAAAAAABUAQGJsb2NraGFzaEBiaXRjb2luLm9yZzAw
MDAwMDAwMDAwMDAwMDAwY2U0Zjc0MGZiNzAwYmI4YTllZDg1OWFjOTZhYzk4NzE1
NjdhMjBmY2EwN2Y3NmEvFIAAAAAAFQARcGthLWFkZHJlc3NAZ251cGcub3JncGV0
ZUBwZXRlcnRvZC5vcmcACgkQJIFAPaXwkfv/VAf+IeWvhkS0f34Utvi/boR32yRb
8VpizQ+OxAEeLdU0Ot7lwqMbGCsrA8eiyHIiVXeVBv54DLW8AQ55Qt+ge/hirCsN
JZgE7pNt0YZKfxj2AdmCJiL18YuJUnlDd01OJWaz0tQLP6uBjhv2c3U+ZbMT5aBV
ehiyld8oz8/2dOjsnAf3h8VT4dyQK9L1PQmzXCXoASTPqBZubPdeRQGT/5OVXtc0
goZgW7GsL+o/0n5748HHde3xKvaWz0j6UiK5vhlUrLK5jHgifOhLuiC8enu0Z/3t
0fVnuws8aiciSZIluWa5ZzSX82HVQ+G781eXIa24jgHScrMvR5affPbmVZRQOw==
=D7bn
-----END PGP SIGNATURE-----

--zx4FCpZtqtKETZ7O--