It will be the case very soon that you can push your key to Keybase and prove all your identities, without ever installing the client the OP dislikes. Technically, you can already, we just need to put together very explicit instructions and documentation that's different for each kind of proof. By ugly necessity, what it takes to prove yourself on twitter is different from github is different from DNS, etc. Documenting the API was our priority coming into this week.
Later this week the site will have very specific instructions on how to prove your identities (even the complicated ones) simply from your shell plus GPG.
Then those who care can verify all those proofs with a script, in a language of their choice. No Node or NPM needed for any of it.
There was some discussion below about "trusting" the Keybase server's definition of the public key that comes back. The goal here is to remove that trust. Software of your choice can download a Keybase user's keys, the links to their proofs.
Just a thought: I like how you walk the user through the steps you took to prove that the owner of the private key signed the tweet. I suggest you also provide the appropriate commands to perform the verification ourselves as well. The client does this, but for users operating without it it'll be very useful.
curl https://keybase.io/[them]/key.asc | gpg --import
Additionally, I have used GPG and their website with javascript based crypto in some cases without using their NPM app. I believe their goal is to get other client implementations out there on the public api.
http://www.onebigfluke.com/2013/06/bootstrapping-webfinger-w...
I've not actually tried it yet, but it looks pretty damn cool.
Anyone running a full Namecoin node (ie, anyone running Namecoin client) can register an identification.
OneName is providing a convenient web portal to this key-value store on Namecoin, so their business model is somewhat analogous to Blockchain.info's (or perhaps they have another business model in mind, who knows?).
The annoying thing is, we already have a namespace for identities, it's standardised and documented on the wiki. They came in and defined their own namespace for no good reason.
https://wiki.namecoin.info/index.php?title=Identity
Basically, there's a whole id/ namespace where you register your personal information, and there's a d/ namespace where you register domain names (akin to DNS). Onename is the same except they use i/ (they haven't even tried to discuss it and basically did it all from scratch to start clean)
The major problem is that you basically need a namecoin client to interact with the data... unless you use dnschain [0], which act as a HTTP-to-Namecoin and DNS-to-Namecoin bridge. Try this:
$ dig @dns.dnschain.net otokar.bit
$ curl http://dns.dnschain.net/d/otokar
both are my personal domain, delivered to you through plain old protocols. The last one even works in your browser !
Come and join us, this is actually the future. Oh and by the way I'm id/rakoo.
Your OS's package manager is simply wrapping up whoever else's software in a nice pretty bow and releasing it. The only veracity it has is that the person who put the bow on it signed it. It's highly unlikely they did any kind of "independent auditing" or managing beyond writing some script to build the software.
Or worse: if Debian is an example, they'll say "I don't understand this code, therefore it's not useful", comment it out, and ship horribly broken software to you.
At the end of the day, you have to trust someone. Whether you trust keybase.io or not is entirely up to you - liz setup an incredibly tedious blog post to basically say just this.
If I cared, I could even cross-verify across distributions by comparing their source tarballs.
> Or worse: if Debian is an example, they'll say "I don't understand this code, therefore it's not useful", comment it out, and ship horribly broken software to you.
The other point of view: they fix software so that it is useful, and I can easily have an integrated system. For the one problem you point out, there are hundreds (or probably even thousands) of useful integration patches that distribution users take advantage of every day, without even realizing it (and those suitable for upstream projects generally get pushed that way, too).
If you don't like distributions, then don't use them. And have fun with that.