PGP-key-based authentication system Consider we implement remote service, which will be accessible via API(i.e. restful http or grpc). All users are authenticated via pgp keys and each user has pgp keypair.

How to implement authentication for such a service?

I see multiple approaches and I'm unsure which one to choose:


Convert keypair to X509 certificate, use TLS certificate authentication (1, 2) to authenticate users. Requires some fiddling on client side, also unclear how to convert.
Require users to sign timestamp on each request. Check that timestamp is close to current server time. Unclear if this approach is secure.
Give users expirable tokens, which are either stored in DB or have MAC, require users to attach token signatures.
Some better approach I cant think of
Sign a self-signed X.509 certificate using PGP signature generation.


Let the web user create a self-signed X.509 certificate and store the certificate and private key in a PKCS#12 key store. Then create a PGP signed container with this certificate included. Let the web server put it in a trust store after verifying &amp; stripping the PGP signature. The client needs to configure the PKCS#12 soft token with the browser used (or the Windows store, if IE / Edge / another SChannel based browser is used).

You would need to provide guidance to the users on how to create the self signed certificate and how to put the self signed certificate and private key store in the local key store of the browser. You could also create an application to do this for the users.