I have a small web forum and would like to promote the use of PGP signing of messages. Users can sign their posts and verify the posts of other users but currently the process is manual. Depending on the software they're using and OS integration some users can use keyboard shortcuts to sign their messages or verify messages from other posters, but some are simply copy/pasting content between another piece of software and the forum. This seems fine from a security perspective but it's not a great user experience.
Ideally I'd like to request signing before message submission from the user's local PGP software so my service never comes into contact with private keys in any capacity, it simply requests signing from some service that's aware of the user's private key, receives a signed response, and stores that. Is this possible? Would this represent a risk (from the user's perspective) of a chosen plaintext attack?
On the other side it would be nice to automatically verify signed messages. This seems more difficult since even if I as the service know every user's public key and can do the verification, users still have to take it on faith that my reporting of signature verification results is reliable, although perhaps there's some way for the user's software to report verification failure.
Does anything like this exist where a website can request crypto services from another piece of software that's trusted by the user? Is there any fundamental security issue with such a setup?
