+ "*may*", and "*optional*" to be interpreted as defined in [[https://tools.ietf.org/html/rfc2119][RFC 2119]].
+
+ The following terms have these definitions:
+
+ - *AP* means ActivityPub.
+ - *AS* means Activity Streams.
+ - *AS2* means Activity Streams 2.0.
+ - *AC* means Active Cryptography or Activity Cryptography; the
+ working title for the protocol extension.
+
+ The document also draws on the same RFCs cited by both the Activity
+ Streams [[https://www.w3.org/TR/activitystreams-core/][core]] and [[https://www.w3.org/TR/activitystreams-vocabulary/][vocabulary]] documents, as well as the [[https://www.w3.org/TR/activitypub/][ActivityPub]]
+ protocol definition.
+
+
+* Cryptographic Activities
+ :PROPERTIES:
+ :CUSTOM_ID: crypto
+ :END:
+
+ This section introduces the new objects, collections, activity types
+ and properties necessary to implement OpenPGP functions with
+ Activity Streams 2.0 and ActivityPub.
+
+
+** Cryptographic protocol
+ :PROPERTIES:
+ :CUSTOM_ID: crypto-protocol
+ :END:
+
+ In order to handle any situations in which servers and/or clients
+ may implement multiple cryptographic protocols, a property *must* be
+ set for any cryptographic object or activity.
+
+ #+begin_src javascript
+ { "cryptographic-protocol": "openpgp" }
+ #+end_src
+
+ Where the relevant JSON data is already clearly part of a
+ cryptographic object or activity this proprty *may* be defined as
+ =protocol=.
+
+ #+begin_src javascript
+ { "protocol": "openpgp" }
+ #+end_src
+
+
+** MIME and file types
+ :PROPERTIES:
+ :CUSTOM_ID: crypto-mime-types
+ :END:
+
+ The media or content types utilised are adapted from the PGP/MIME
+ types defined in [[https://tools.ietf.org/html/rfc2015][RFC 2015]] and [[https://tools.ietf.org/html/rfc3156][RFC 3156]]. Specifically this covers
+ the =pgp-keys=, =application/pgp-encrypted= and
+ =application/pgp-signed= MIME types.
+
+ In addition to these an implementation *may* utilise
+ =application/pgp-encrypted+activitystreams= and *may* utilise
+ =application/pgp-signed+activitystreams= to indicate an Activity
+ Stream object (i.e. an =application/activity+json= object) is
+ either entirely affected by the cryptographic function or the
+ object is OpenPGP data which contains an ActivityPub or Activity
+ Strams object or activity type which will need to be processed upon
+ decryption or signature validation.
+
+
+** Keys
+ :PROPERTIES:
+ :CUSTOM_ID: crypto-keys
+ :END:
+
+ Unlike the PEM key included with ActivityPub instances, OpenPGP
+ keys are always intended to be generated by the end user(s)
+ controlling a given actor's account and not controlled or accessed
+ by the server, even when that server is controlled by a single
+ user.
+
+ There are also valid reasons or use cases for assigning multiple
+ keys to an actor or using the same key with multiple actors. This
+ is particularly the case if proof of OpenPGP key control was
+ adopted as an alternative means of providing authentication between
+ a client and server, in addition to OAuth methods.
+
+ Though there is already a well established network of public
+ keyservers, the SKS keyserver pool, and from GPG 2.1 there is an
+ alternative method of retrieving keys associated with a domain name
+ built-in; there are also valid reasons for not using these methods
+ of providing access to a public key used with activities.
+
+ Likewise, there is a need for serving key information with actor
+ information and referencing it with objects and activities where
+ necessary. This would effectively turn an ActivityPub instance
+ into a limited public keyserver for the keys assigned to actors
+ under its purview, though it may not maintain or serve copies of
+ those keys containing full web-of-trust signatures, particularly if
+ there are size constraints or bandwidth limitations.[fn:1]
+
+
+*** Public keys and Actors
+ :PROPERTIES:
+ :CUSTOM_ID: crypto-actor
+ :END:
+
+ In order to enable access to cryptographic information controlled
+ at the user level we need to add an optional property to actors;
+ one where the absence of it equates to a value of =None= or
+ =null=.
+
+ Since it is theoretically possible for multiple cryptographic
+ protocols to be in use, in addition to the Linked Data and HTTP
+ Signatures referenced in the ActivityPub specification, this
+ optional property *must* contain an array of JSON data listing the
+ =protocol= or =cryptographic-protocol=, the =cryptoContext= for a
+ URI of a collection containing more relevant data, the
+ =publicKeys= for an additional URI just for checking public key
+ data and *may* contain a =primaryKeyID= referencing the preferred
+ key ID used with the actor.
+
+ Here is an example using the same actor example in the ActivityPub
+ specification. Note that the key ID or fingerprint used here does
+ not exist on the keyservers and is really just a SHA1 sum of the