- Prevent any single individual from revoking our signing key.

Prevent any single individual from revoking our signing key.

Group A: people from tails@boum.orghe Board themselves

Group A: people from the Board themselves

Three people from tails@boum.orghe Board: A{3}

Three people from the Board: A{3}

Two people from tails@boum.orghe Board and one person not from tails@boum.orghe Board: A{2}+(B|C|D)

Two people from the Board and one person not from the Board: A{2}+(B|C|D)

One person from tails@boum.orghe Board, and two people not from tails@boum.orghe Board but from two different groups: A+(B|C|D){2}

One person from the Board, and two people not from the Board but from two different groups: A+(B|C|D){2}

Three people not from tails@boum.orghe Board but from three different groups: (B+C+D){3}

Three people not from the Board but from three different groups: (B+C+D){3}

N shares, one for each person from tails@boum.orghe Board

N shares, one for each person from the Board

People from tails@boum.orghe Board know the composition of each group

People from the Board know the composition of each group

Three pPeople not from tails@boum.org: A{3}he Board:

People not from the Board:

We are proposing this to you because we trust in both your technical abilities to store your share in a safe place and manipulate it as required b. But also because we trust in you as a human being to make informed judgment on when to use your share and act only in the interest of Tails.

We are proposing this to you because we trust in both your technical abilities to store your share in a safe place and manipulate it as required. But also because we trust you as a human being to make informed judgment on when to use your share and act only in the interest of Tails.

A. The signing key is not revoked whilen it should be. This could allow possible attackers to distribute malicious Tails ISO images or publish malicious information on our name.

A. The signing key is not revoked when it should be. This could allow possible attackers to distribute malicious Tails images or publish malicious information on our name.

B. The signing key is revoked when it should not have been. This would prevent people from verifying our ISO images with OpenPGP until we publish a new signing key and build trust in it.

B. The signing key is revoked when it should not have been. This would prevent people from verifying our images with OpenPGP until we publish a new signing key and build trust in it.

Each person from tails@boum.orghe Board, group A, has a *different* share, A1, A2, ..., An.

Each person from the Board, group A, has a *different* share, A1, A2, ..., An.

When to usHow to store your share

How to store your share

ChangKeeping the members of the groups B, C, or D
and D up-to-date

Keeping the members of the groups B, C, and D up-to-date

<pre>
Subject: distributionupdate

<pre>
Subject: update

We want to propose youSome years ago, you agreed to be part of a distributed mechanism for the revocation certificate of the Tails signing key and we sent you a cryptographic share of this revocation certificate.

Some years ago, you agreed to be part of a distributed mechanism for the revocation certificate of the Tails signing key and we sent you a cryptographic share of this revocation certificate.

RequestIf they agree, ask someone else from thate same group to send them their share tof the new person in the groupkey.

If they agree, ask someone else from the same group to send them their share of the key.

<pre>
Subject: distributionsharing

<pre>
Subject: sharing