Re: Valid OpenPGP keys without self-signature?

[Lutz Donnerhacke <lutz@xxxxxxxxxxx>]

* aboietf@xxxxxxxxxxxxxxx wrote:
> (1) Are such keys a security problem?

In general: Yes. In this particular case: No.

> (2) Is such a key conforming to the OpenPGP spec (or at least
>     interoperable with a conforming OpenPGP product)?

There are 2.6.x versions of PGP generating keys without a self signature.
So they are introduced and common, despite considered obsolet.

> (3) Which OpenPGP products support such unusual public keys?

There is a strong movement to require the self signature. This is currently
work in progress on the whole key space.