Let me begin by distinguishing two kinds of identity theft:
- Conventional identity theft (e.g. using credentials from ID documents, bank accounts, etc, to commit fraud or other mischief).
- Cryptographic identity theft (e.g. using a PGP certificate (aka "key") to impersonate another PGP/GPG user without their permission).
Key signing parties (KSPs) are intended to make cryptographic identity theft harder, but as they typically require exposing credentials from government-issued ID documents, bills, or similar, to people who would not normally have access to them, they would seem to increase the risk of conventional identity theft.
I can think of a couple of ways to mitigate against this increased risk:
- Covering passport numbers, dates of birth, driving license numbers, etc, before showing the document at a KSP;
- Only signing keys belonging to people known well enough that the showing of additional credentials is not required (e.g. family, or long-standing close friends), and expecting the same in return;
However, the first might reduce trust, and the second would seem to make KSPs unnecessary.
So, I'd be grateful for others' views on how people should gain the benefits of KSPs without putting themselves at increased risk of conventional identity theft, and for pointers towards any research that has addressed this.