Public Keys comes up in 4 chapters across 4 episodes of Podcasting 2.0, from May 2026 to August 2026, with guest John Spurlock.
Dave Jones explains the decision to remove DHT from Podping due to stability issues with the Eero library. The system has transitioned to using five hardcoded bootstrap nodes located in Australia, Central, East, Europe, and West, which utilize permanent public keys for coordination.
To resolve blocking issues, Dave Jones implemented HTTP signing using Cloudflare's "web-bot-auth" protocol. He repurposed existing Rust code from the ActivityPub bridge to publish public keys on podcastindex.org, though he notes that Cloudflare has yet to officially verify the bot despite the implementation.
The discussion explores a hypothetical scenario where platforms like Spotify or Megaphone implement "verified apps" using cryptographic signing. Dave Jones suggests that much of the current industry abuse stems from "carelessness" in "Vibe Coding" rather than intentional malice.
The Open Podcast Analytics Working Group (OPAWG), led by John Spurlock and James Cridland, is suggested as a potential host for a repository of validated public keys. This system would allow hosting companies to restrict high-bandwidth content to verified clients, potentially solving the bot traffic problem without requiring a centralized blocklist.
