I was thinking about creating a proof of concept for the following type of website login system.
Instead of passwords being used, on account creation, a public GnuPG key is uploaded to the server, and that serves as the main form of authentication for a users account. To login, the user would give their username. The login app would get the usernames public key, encrypt a random string with their public key, and the user would have to decrypt that downloaded file, and used the decrypted string as the password.
Does there seem to be any flaws in that system? If the user is able to keep their key secret, I don't see why this type of system wouldn't be feasible.
What do you think?