🚀 go-pugleaf

ygoland@edison.seas.ucla.edu (The Jester) writes:

>[Lots of stuff with which I basically agree]

However, you also write,

>The most important aspect of key verification is the trust factor,
>person A trusts Person B who trusts &  verifys person C's key. Thus person A
>is supposed to accept C's key with B's validation. This chain can be
>extended infinitely.

It *can*, but only if you (A) allow introducers (B) to introduce
introducers (C).  PGP has a parameter in its config.txt file that
allows you to tell PGP how deep the certification process may become
(it's called CERT_DEPTH I think, and its default is set to 4).

Furthermore, there is a difference between the *validity* of a key and
the *trust* you put in its owner.  You may believe that a certain key
is from Billy, but wouldn't trust Billy to sign any other keys
competently.  On the other hand (this is far-fetched), you might trust
somebody's ability at key management but might believe that his key
has been exposed or otherwise cracked.

Have fun.

-- 
Stephan <neuhaus@informatik.uni-kl.de>
sig closed for inventory.  Please leave your pickaxe outside.
PGP 2.0 public key available on request.