Requiring a signature is not automagic authentication

[darosior]

I spec'ed that the spend_opinion requires a signature from the watchtower.... But did not specify the actual public key used by the recipient to verify it !

That's YA key exchange that needs to be done.

[darosior]

We could also trust the sync server for not malleating the opinions.. Worst case there is a revault. EDIT: arguably worse case a "yes" is malleated to "no"

[darosior]

So the meeting settled on: "Let's get rid of the signature". Thinking more about it that's not reasonable, as there is the reason field that can be malleated as well and is displayed on the GUI. That's a pretty obvious threat...

[darosior]

Ok (after discussions with @JSwambo) so we'll have keys everwhere anyways!

• Stakeholders have each other keys
• Managers have WT keys

[darosior]

We also need to make the pukeys part of the message (using key recovery would be useless here)

[darosior]

Now that network.md is merged we can link to it :)

[darosior]

Actually the pubkeys used are different