To PKI or not?

[rmbaxter67]

To create the site-to-site mesh needs a trust model and agreements on who (legally) can represent a given Connector (as it were) and how their identities are bound to keys -- a PKI infrastructure, Are we going full PKI or is there some other way to do it? Are there pieces of UK science infrastructure we can leverage here? If we have a PKI, where is the CA/RAs?

[JimMadge]

Picking up a thread from the TREvolution showcase, there was a question about how we can ensure the metadata in a Five Safes RO Crate is correct. For example, how to know that the record of transformations is correct, or the provenance is correct.

Signing the metadata (and a hash of the data) wouldn't prove these things, but it would create more trust. You can verify that the signature is valid using the public key, and then decide whether you trust the owner of the private key.

The blocker there, as with Connector, is how to build our chain of trust and vouch for each other. It feels to me like another place where a Trusted Research key repository would be beneficial.

[manics]

Related #5
Flower AI uses a CA and certificates for all nodes in the federated analysis, i.e. at the application level.