From 870f09d124ef82ad43e2a062253866ec63972487 Mon Sep 17 00:00:00 2001
From: Paul Schaub <vanitasvitae@fsfe.org>
Date: Sat, 21 Jul 2018 11:21:44 +0200
Subject: [PATCH] Add anchors and hint about the fingerprint

---
 xep-0373.xml | 21 +++++++++++++--------
 1 file changed, 13 insertions(+), 8 deletions(-)

diff --git a/xep-0373.xml b/xep-0373.xml
index bccf3d40..b68a5446 100644
--- a/xep-0373.xml
+++ b/xep-0373.xml
@@ -149,7 +149,8 @@
     <di><dt>Public-Key metadata node ("metadata node")</dt><dd>A PEP node containing metadata of the entity's public OpenPGP key.</dd></di>
     <di><dt>Public-Key data node ("data node")</dt><dd>A PEP node containing an entity's public OpenPGP key.</dd></di>
     <di><dt>Secret-Key node</dt><dd>A PEP node containing an entity's encrypted secret OpenPGP key.</dd></di>
-    <di><dt>OpenPGP v4 Fingerprint String</dt><dd>A String representing the OpenPGP v4 fingerprint of a key.</dd></di>
+    <di><dt>OpenPGP v4 Fingerprint String</dt><dd>A String representing the OpenPGP v4 fingerprint of a key. If the key consists of a master key and subkeys, this is the fingerprint of the 
+master key.</dd></di>
   </dl>
 
 </section1>
@@ -475,12 +476,12 @@
     owner is whitelisted as described in &xep0223;. The secret key is
     additionally encrypted.</p>
 
-    <section2 topic='Required PEP features'>
+    <section2 topic='Required PEP features' anchor='synchro-pep-requirements'>
 
       <p>The used PEP server MUST support PEP and the whitelist access
       model. It SHOULD also support persistent items.</p>
 
-        <section3 topic='Discovering support'>
+        <section3 topic='Discovering support' anchor='synchro-pep-discover-support'>
 
           <example caption='Account owner queries server regarding protocol support'><![CDATA[
 <iq from='juliet@capulet.lit/balcony'
@@ -531,7 +532,7 @@
       clients first need to discover and verify the node for the correct
       settings.</p>
 
-      <section3 topic='Client Sends Request'>
+      <section3 topic='Client Sends Request' anchor='client-sends-secret-request'>
 
   <example caption='Requesting the user&apos;s secret key.'><![CDATA[
 <iq from='romeo@example.org/orchard'
@@ -545,7 +546,7 @@
 </iq>]]></example>
 
       </section3>
-      <section3 topic='PEP Service Success Response'>
+      <section3 topic='PEP Service Success Response' anchor='client-receives-secret-response'>
 
   <example caption='Personal Eventing Protocol result containing the requested secret key.'><![CDATA[
 <iq from='juliet@example.org'
@@ -564,7 +565,7 @@
 </iq>]]></example>
 
       </section3>
-      <section3 topic='PEP Node Does Not Exist Response'>
+      <section3 topic='PEP Node Does Not Exist Response' anchor='error-pep-node-inexistent'>
 
         <p>If the node does not exist the service will return an &IQ;
         error indicating the item-not-found error condition. The
@@ -582,7 +583,7 @@
 
       </section3>
 
-      <section3 topic='PEP Not Supported'>
+      <section3 topic='PEP Not Supported' anchor='pep-not-supported'>
 
         <p>The service will return a service-unavailable error &IQ; if
         it does not support PEP.</p>
@@ -600,7 +601,7 @@
       </section3>
 
     </section2>
-    <section2 topic='Creating the Secret Key PEP Node'>
+    <section2 topic='Creating the Secret Key PEP Node' anchor='create-secret-node'>
 
       <example caption='Client creates secret key PEP node'><![CDATA[
 <iq type='set'
@@ -632,6 +633,10 @@
       bare JID of the user, who created the node, with an affiliation as
       'owner'.</p>
 
+    </section2>
+
+    <section2 topic='Encrypting the Secret Key Backup' anchor='backup-encryption'>
+
       <p>In order to set a new secret key, clients store the encrypted
       secret key as Base64 encoded raw OpenPGP message within an
       &lt;secretkey/&gt; element qualified by the 'urn:xmpp:openpgp:0'