Friends should not be able to share VCARD but by-friend-invite-links

Feature Proposal
1

Deltachat user A is friend with user B.

B is able to share A VCARD to new friends. This VCARD contains the public key of A, and his profile picture. This VCARD can not be revoked by A.

B should not be able to share this VCARD.

B should be able to share an invite link of A, generated specifically by B using both public keys of A and B. When a new friend C tries to contact A via the invite link shared by B :

  1. Deltachat (of A) should not accept initial contact messages from VCARD, only initial messages coming from invite links.
  2. Deltachat (of A) detects that the invite link used where shared by B (because signed with public key of B)
  3. If A has blocked B, then the message of C is discarded and not displayed to A. It prevents spam coming blocked users who shared your invite link on the internet to annoy you.
  4. If A has not blocked B, then the initial message of C is displayed to A, with an information box telling that C is contacting A through B (so, A can know C is using a invite link from B).
  5. A can “reinitialize” the invite-link of B (it sends a service-message to B and both reinitialize the invite-link). It avoids spam if C leaks the invite-link but A and B are still friends.
2

I’ve already described a solution to this here just recently. It’s basically token-based mailbox localpart subaddressing and using a unique token for each person you communicate with. This would create a unique vCard for each contact and each one would only be usable by a single peer (a single fingerprint).