Walfield, N.H. and Koch, W. (2016). TOFU for OpenPGP. Proceedings of the 9th European Workshop on System Security, pp.1–6. doi:https://doi.org/10.1145/2905760.2905761.

Like OpenPGP Web-of-Trust Public Keys Infrastructure… trust user public keys, not a photo/nickname profile… BTW, the TOFU concept is also an interesting one…

My uni research is more or less about reproducible environments. I'll have a look at it and see if I can help.