Trust, UIDs, signing & revoking

[David Shaw]

--BOKacYhQ+x31HxR3
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Tue, Nov 20, 2001 at 01:00:53PM +0000, Phil Brooke wrote:
> Suppose I have a key with several UIDs.  I now revoke one of the UIDs
> (suppose that email address is no longer valid).
>=20
> Do the signatures from other people on that revoked UID still count
> towards any trust calculations?  (Assuming that they've only signed that
> UID, and no others.)

They do not count.  Trust is given in a key+UID, so if the UID is
revoked, any trust in that key+UID is effectively revoked as well.

> I'm thinking about the problem where email addresses tend to be rather
> short-lived.  Should a UID with just the name be added for the purpose of
> collecting signatures?

It's not uncommon.  Another way to handle it is to get a "lifetime"
email address - a la acm.org, or pobox.com, which forwards to your
real email address.

David

--=20
   David Shaw  |  dshaw@jabberwocky.com  |  WWW http://www.jabberwocky.com/
+--------------------------------------------------------------------------=
-+
   "There are two major products that come out of Berkeley: LSD and UNIX.
      We don't believe this to be a coincidence." - Jeremy S. Anderson

--BOKacYhQ+x31HxR3
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6b (GNU/Linux)

iQEVAwUBO/qTPoccwqs8s7QVAQFO+Qf8CYQyIfozeO+FT32sVtzfT4FAuFqHzJrp
Qo+pYll0Vi0ujeoD0yNZbGEEv7SAGBaISHL6V85e/2grqhkoc1T+Z9c/zJUC2eTn
8pgv/g+AykZonJ9yaW7GIaSV0BiIXiFt5MXnJ471D4z/c27KhZAE8iGxXt8prsoO
Gn67Rs+wx+JdSLbPejmxtMAQEMEXDI9Fj1i04RsyXNzN9eYI0jaKzW/jhDV4OJEk
PoTBQIBIEZ22Jc28OXXeO2Tl7EHHa1am+CwEIR7qyKLDsKn691ZEvzBSSZ/JyzyX
svjQQcnz819CjkdFb4HDCk1Y9u7Q6o+2amS0B5q6deGehj5U+fEpVQ==
=Ggn0
-----END PGP SIGNATURE-----

--BOKacYhQ+x31HxR3--