the GPG trust model

[Joel N. Weber II]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

   > There's also the problem of people who cross-sign their own keys.  I'm
   > willing to trust cross signed keys somewhat morethan I'm willing to
   > trust a key to sign other people's keys in some cases, and GPG doesn't
   > give me an easy way to express that.

   Hmmm. This reminds me of a wishlist type request I've thought of some
   time back:=20

   I want to be able to specify that two keys belong to the same person and
   should be considered equal in trust calculation (meaning primarily: the
   hop should not be counted, and signatures with marginal trust should be
   added up over both keys).

There are other fun cases, too.

I have two keys.  They aren't exactly equally trusted; indeed, the
``LOW SECURITY KEY'' which is signing this message won't be used to
sign other people's keys, and you shouldn't trust it to sign other
people's keys.  You probably shouldn't trust it to sign ssh-gpg code,
either.  On the other hand, any email you send me should be encrypted
to at least this key, and possibly to the other key as well, because
this key lives on the machine I run my mailreader on.  (Unless it's
excessively sensitive email, but if it's something you'd potentially
be willing to send unencrypted if I wasn't using GPG, you should make
sure it's encrypted so that the low security key can read it.)

Then there's the problem that I have about a dozen email addresses
that I actually use, and I don't really want uids on my keys with all
the addresses I have, because many of the addresses are somewhat
secret.  This means that my friends get annoyed that there's not a uid
for the address that they're sending mail to.

And how do I tell GPG which of my keys to use when sending a message
to me?  I have a hack for mailcrypt to make it DTRT, but it really
feels like gpg might be a more appropriate place to read the config
file for that.


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.0 (NetBSD)

iD8DBQE9mQASNIJPyVx4GhgRAo4qAJ9sOMOqKV5UxbH8C6odZFLjXbIeGwCg2Jxw
lVOgOsD0ZGOsyTB29diPTYA=
=duZ3
-----END PGP SIGNATURE-----