Needed info:

• Vendor Name
• Package Name
• One or more of the following:
  • Update file contents
  • URL pointing to direct file download location
• Public Key ID for file signature
• Signature of file contents

• Register new account from website
• Send verification email
• Verify token sent to inbox
• Login with username / password
• If no device token (regardless of password correctness) for the given username, prompt for TOTP code
• Logout (with CSRF protection)
• Same-Site, HTTP-Only, and Secure cookie flags

Needed info:

• Active account ID (required for authentication)
• Vendor (accounts have a many-to-many relationship with vendors)
• Package name
• Platform
  • RPG Maker XP
  • RPG Maker VX
  • RPG Maker MV
  • Game Maker 1
  • Game Maker 2
  • etc.
• Type
  • Available types are entirely platform-dependent

Needed:

• Account ID (needed for auth.)
• Vendor ID
• Public Key

Depends on #4

• Trillian: https://github.com/google/trillian
• Chronicle: https://github.com/paragonie/chronicle

To do:

1. Decide which is more appropriate for our use case
2. Build Transparent PKI based on verifiable data structures with decentralized verification

Needed info:

• Account ID
• Public Key ID
• Sign-Off Key ID
• Reason (text)
• Signature of reason

The Revocation API will allow an account to say "this public key has been compromised" in an irrevocable, public way. Revoked public keys will be distrusted from that point in time forward.