That doesn't mean anything. Anyone can request to have their root CA signed by the FBCA. Most govt agencies and many concrractors do this. It's not hard just a lot of paperwork. I have not done it but have two industry friends that have, in past jobs.

What you're describing is likely a subordinate cert which is signed by the 2013 or 2016 CA which in turn is signed by the US government common policy CA. It's not administered by Serco it's administered by a US govt organization.

I have the chain installed on my PC as a matter of fact. You can look at it or install it from various sites. I found it most easily on the US Treasury's site but there are others. CA is just to establish a chain of trust. Windows pushes out all the most common CA's including Commodo, Thawte, DigiCert, etc. you have to download the US govt root cert and Federal sub very manually though because windows doesn't distribute it by default. But if you're on a government machine it's likely pushed out by the group policy of whatever agency it is- their AD domain.

Certs and Authorities are no big deal, even the federal one which aimed to simplify things but in reality it can kind of be its own bureaucratic mess at times. With certs and authorities, all websites would be running self-signed certificates and you'd need to accept every certs upon hitting an organization's https default page on their site. Instead we have a framework for certs, and the fact that the US government has their own infrastructure for this makes sense given that you don't necessarily want it in the hands of third party companies contracting with every govt department or agency. And if that is the case, then it needs to be governed. You can read the policy framework documentation online if you just google for it.

I do in fact, and I am trying to share it by explaining. I didn't call you any nasty names so why are you calling me a cunt?

I do network security for a living and know much about this and it is frustrating when misinfo gets posted so that's why I correct it. I could have not explained anything and told you to look it up for yourself. Alice and Bob. This is computer science sophomore year stuff.

To be fair, I think those examples ARE suspicious the problem is you won't get anything from this unless you try to bait the individuals themselves. But you will need a key pair of your own and you'll need to email them from an anonymous email because you are taking more of a risk emailing them than they are by posting their keys.

I explained why people post them on LinkedIn and MIT site; it's so people can email them in encrypted pgp form without you having to first engage them to ask for it. It's like a directory for pgp email users. There is nothing nefarious about posting your public key online, whether LinkedIn or MIT. I post mine on my old college sever. In this case I don't believe one even needs to have gone to MIT to post their key. They just operate the server hosting the keys so if i recall correctly anyone can post their key, including CP traders.

And I am not encouraging people not to look at anything. In fact I encourage EVERYONE here to use pgp in their communications and to not only encrypt their emails with the recipients public key but also to sign yours with your key as well to guarantee that you are in fact the sending, guaranteeing message authentication and integrity. And when you do use it, please upload your public key on to a public server that people can send you a first email encrypted right off the bat without having to introduce the unnecessary step of asking for your public key first.

Again I confirm that I believe those emails to be suspicious but like I said before you won't be able to do anything with their public key because it's already public for a reason - by nature of how pgp is design to work. Even to decrypt the messages you'd not only need their private key but also direct access to their mailbox via imap, pop3, Mapi or some kind of webmail access - so it's like having two separate barriers to get past.

My point is that I would hate to see people spin their tires trying to apply public keys to a scenario where it is impossible to gain anything of value from, unless you bait the individuals which I don't recommend because they have more to hide than you do and they have a higher chance of being able to find out who you are vs you finding out about them, especially if they have a solid understanding about security protocols and best practices and you don't. For instance if I asked if you are experienced in analyzing smtp headers, can explain what MX and TXT:SPF records do and what DNSSEC is? If not then please don't even try to attempt to email these people because you have a very high chance of giving your self away including your IP address or employers IP address(es).

One has to be careful out there. So please folks devote an hour or two a week to learning. Security knowledge isn't supposed to be hoarded it is supposed to be shared and fostered. Using security is not a mark of guilt but rather a crucial step in persec and opsec.

Does this clarify my prior post?

My recommendation is not to try digging into pgp angle but rather compile the list of all suspicious addresses and begin scouring the web for them. You might even find databases with the email addresses in them. I won't say what kind because doing so crosses a line of potentially encouraging illicit activities but after searching for around 10 email addresses online it's only a matter of time before it leads to a dump of email addresses along with the other important thing associated with them -- and the data is usually the result of a hack or leak. That would give better leads than trying to aggregate information about the pgp keys.