Use Public-Key-Criptorgray instead of emails

[BusHero]

SponsorLink uses email to check whether a user does sponsor a project. There are several problems with this approach

• User might have multiple emails
• User might not have an account on GitHub
• User needs an additional application installed to verify the email

There are other ways to check the user is sponsoring a project without involving email or any other external services, one of which is the use of public-key-criptography(name might be wrong).

Here is the basic workflow:

1. Author generates a pair of private/public keys
2. Author stores the public key with the source code of the library
3. User sponsors the project
4. Author is notified(ex github action trigger)
5. Author generates a message and encrypts it with the private key(ex. inside a github action?)
6. Author sends the encrypted message to the user(ex. through the email)
7. User put the encrypted message inside the well known environment variable
8. Library tries to decrypt the message using the public key. A success means that the user is sponsoring the library.

Such a workflow excludes the use of any personal information as well as any external applications.

PS. I'm not an expert in cryptography and ignorant about any pitfalls

[kzu]

This is pretty much what I implemented in the new manifest-based approach. Learn more at https://www.devlooped.com/SponsorLink/spec/.

Thanks!