Signing a key (meaning)
faramir.cl at gmail.com
Fri Apr 8 02:29:55 CEST 2011
-----BEGIN PGP SIGNED MESSAGE-----
El 07-04-2011 13:06, Charly Avital escribió:
> In another forum, one of the members signed my public key and uploaded
> it to the keyservers with his/her signature, without asking nor
> notifying me (the key was already on the key servers, but without this
> added signature)
Oh, well, encryption faeries soon or latter will upload your keys to
keyservers. And you can't prevent people from signing it, specially the
newbies reading support lists.
> I didn't invite this person to sign my key.
Yes, but the default setting of GnuPG is not encrypt to untrusted
keys, so the first thing a newbie might do is to sign the keys of people
providing support in the list. After all, "trust all" doesn't sound any
> I don't know this person, never met her/him, never had any contact
> except the fact that we both participate in the same forum, together
> with other members.
And it might be a good reason to issue a local signature, after all,
after reading some messages, we might want to "mark" your key as a key
belonging to somebody that provides advices we can trust. But local
signatures is something we don't learn on the first day.
> I decided against asking this person to revoke the signature.
Yes, that would add more "noise" to your key. People could interpret
it as a signal of distrust, instead a "neutral" signal.
> I generated a new key pair (that I don't intend to upload to any key
> server, but instead I shall send it directly to people whom I correspond
> with), and I shall gradually "phase-out" the previous key, until I
> finally revoke it.
As long as you write in support lists, I think that key would be
useful to you. And don't forget PGP faeries, your new key might be
uploaded, if one day one of your correspondents drink decaffeinated
coffee by mistake.
Maybe we should have a "daily use key" for mailing lists, signatures
on nicknames and so, and another for "business".
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
-----END PGP SIGNATURE-----
More information about the Gnupg-users