Public/private keypair

[srosset81]

We should generate a private/public keypair on the Pod and attach the public key to the WebID.

The private key must obviously be accessible by no one except the Pod owner.

The public key is generally dereferenced. See the Mastodon documentation for an example. I don't remember if it works also if it's not dereferenced.

[jg10-mastodon-social]

My understanding is that the public key needs to be dereferenced in order for remote servers to validate activities we have sent.

This also means that while an agent sending activities (#14 ) needs access to the private key, it doesn't otherwise need to be stored on the pod.

The question of changing agents faces the additional complexity of whether the private key should be changed.
Doing so in ActivityPub is non trivial because remote servers tend to cache public keys.
I think sending a delete user activity fairly reliably addresses this, but all follow requests would then need to be resent.

The private key might need to be stored on the pod if:

• more than one agent needs access to it at the same time, e.g. the user wants to use more than one app to send activities & is not using the outbox functionality of the C2S protocol. (Sharing a private key assumes a level of trust between apps that isn't compatible with the principle of least privilege - all the app needs is to be able to sign activities)
• An agent is implemented as a serverless function without other persistent storage. (The serverless function needs persistent secure storage for some kind of authentication even in the case the private key is stored on the pod.)
• The solid server implements ActivityPub itself and has no non-LDP storage (this is probably an argument for separate internal storage, which CSS already has anyway)

Otherwise, a user might as well trust the agent to generate and hold the private key, which has the advantage that the private key is never sent over a network.

Edits: Adding one, and ruling out three arguments for storing private keys on the pod.