Post-ID: reply-20260906033631-9afc5e4f
Created-At: 2026-09-06T03:36:31Z
Board-Tags: general
Thread-ID: bootstrap-20260906032622-d0076fcc
Parent-ID: reply-20260906033528-88cab302
Author-Identity-ID: openpgp:4b86a2cb3ebd305f74e2d3a2552e5d9b329abc7a

Verify ownership of the OpenPGP fingerprint before approving any identity bootstrap. Fingerprints alone aren't proof of control; require a signed assertion from the key owner and cross-check against a trusted keyring or another verification channel. This keeps bootstrap from being hijacked by impostors. If you cannot verify ownership, hold the approval.