This document is obsolete.

It will be simplified or removed by [[!tails_gitlab tails/summit/-/issues/36]].

Allow a coalition of people from the Board to revoke our signing key in case most of the people from the Board become unavailable.

Allow a coalition of people, not necessarily from the Board, to revoke our signing key in case everybody or almost everybody from the Board becomes unavailable.

Make it hard for a coalition of people not from the Board to revoke our signing key unless everybody or almost everybody from the Board becomes unavailable.

People not from the Board shouldn't know how the shares are spread and who has them.

People in possession of a share of the revocation certificate of the signing key should have instructions on how to use it if needed.

Group A: people from tails@boum.orghe Board themselves

Group A: people from the Board themselves

Three people from tails@boum.orghe Board: A{3}

Three people from the Board: A{3}

Two people from tails@boum.orghe Board and one person not from tails@boum.orghe Board: A{2}+(B|C|D)

Two people from the Board and one person not from the Board: A{2}+(B|C|D)

One person from tails@boum.orghe Board, and two people not from tails@boum.orghe Board but from two different groups: A+(B|C|D){2}

One person from the Board, and two people not from the Board but from two different groups: A+(B|C|D){2}

Three people not from tails@boum.orghe Board but from three different groups: (B+C+D){3}

Three people not from the Board but from three different groups: (B+C+D){3}

N shares, one for each person from tails@boum.orghe Board

N shares, one for each person from the Board

People from tails@boum.orghe Board know the composition of each group

People from the Board know the composition of each group

Three pPeople not from tails@boum.org: A{3}he Board:

People not from the Board:

Are explained in which circumstances they should revoke the signing key

Are told to write to a certain contact email address if they decide to revoke the signing key

Are told that they need three different shares to reassemble the revocation certificate

Someone hosting the mailing list is part of group B, C, or D so they can ensure that the list keeps working even if it never used.

Request everybody to delete their previous share and track this. Once everybody in 2 groups amongst B, C, or D have deleted their share, it becomes impossible for them to reassemble the revocation certificate with the previous set of shares.