Mikesch,
you might want to look ate the ideas I have for the SCAN repository
regarding users and code signing. Basically, I use the DSA to generate a
public key pair, and every item in the SCAN database is signed by its
owner. What' missing is a certification infrastructure; I was thinking
of something like the web of trust model in PGP. User keys could be
certified either by other users, or (weaker) by servers which interact
through the user's e-mail address. That way, you would have some kind of
initial certification that a public key belongs to an e-mail address,
and for many purposes, this is well enough connected to a real user.
If you need more input, just mail me directly.

Hans-Martin