PGP signatures.

[Patrick O'Callaghan]

On Thu, 2008-05-29 at 10:38 +0930, Tim wrote:
> On Wed, 2008-05-28 at 17:49 +0100, Anne Wilson wrote:
> > It is important, though, to maintain the web-of-trust.  It does have
> > legal implications, and that's why local signing is an option.  I use
> > encryption for correspondence with one person, and for that I have to
> > use ultimate trust, yet I've never met him.
> 
> I don't recall being required to "ultimately trust" someone to send them
> encrypted mail.  I'd call that a foolhardy thing, too.  It'd be better
> to set your mailer to trust people on your keyring - that affects what
> you do with the keys, rather than inappropriately bodging the keys,
> themselves.

Slightly OT, but what the hell: we should realize that trusting keys
isn't the same as trusting people. Trust as applied to PGP/GPG keys
means "I believe this key belongs to this person (e.g. because the
person physically gave me the public key and demonstrated that he could
sign things with the corresponding private one)". It does *not* mean "I
trust this person not to lie to me or do evil with the information I
send him". It's unfortunate that the web-of-trust notion has taken on a
semantic overlay that doesn't fit, due in large part to the unfortunate
choice of terminology.

poc