How OpenPGP identity proofs work