[GTP]

I'm not understanding how this works, then. Are you using the user's private key to somehow derive temporary device keys?

[forgotmypw16]

Generate a PGP key using in-browser JS. Use that key submitted posts.

Then, later, sign either the file hashes or the public key itself using actual secure PGP. This is optional.

I'm not claiming any level of security, this is all mostly UI prototyping.

[GTP]

Sorry, what do you mean by "Use that key submitted posts"?