Linux explores new way of authenticating developers and their code - here's how it works

The Linux Foundation and partners are prototyping 'Linux ID', a decentralized, issuer-agnostic identity layer for kernel developers that replaces the brittle PGP key‑signing web-of-trust with W3C-style decentralized identifiers, verifiable credentials, ephemeral pairwise DIDs, and transparency logs; the approach aims to improve provenance and revocation of developer identities and signed code while preserving privacy and enabling flexible trust policies, but it remains experimental and not yet deployed.