Right, so the flow would be, you get your key compromised, you post some kind of "hey this key is compromised and here's the new one", and the new key's profile has the same nip05 address but with the new pubkey.

Replies (2)

Ya I mean, if my key was compromised tomorrow this is what I would do. I will always have control over cloudfodder@rogue.earth. the only thing is, maybe nobody pays close attention to nip05s, but they could. For example, I used to try to find people that way, when jack deleted his completely I was like wth it used to be @cash.app). But then they became almost as useless as a badge because everyone just wanted a cool badge and the nip05 providers don't go and try to prove it's 'you' in any way other than probably with your nostr key. (that's broken because it makes nip05 useless imho). External validation is the only real way I see to do this kind of stuff..whenever you validate some software via gpg you'll notice this problem, like, which key do I validate with? The answer is you check a few different sources and if the key fingerprint matches you trust it more.