gpg trust system | was: Re: [PHP-GTK] PHP-GTK in PHP Magazine [Re: PHP-GTK in PHP|A]

Hi

UNTRUSTED Good signature from Christian Weiske ... Why does it say it's untrusted? Because you don't trust me. You can use kgpg to set a trust level to my key.

The thing is that you don't know me. The bad man in the middle could have catched my mail to you, encrypted/signed with his key so that you think it is my signature. The same way back. Now if we meet/call each other or meet at a keysigning party, we can exchange our key hashes so that we really can be sure that the key belongs to the other person we expect it to belong to. That would be "ultimative" trust. Now if we exchanged a number of emails, you can trust me a bit. If you send your trust status for me to the keyserver (which is done when updating your current key on the keyserver), the "web of trust" begins: Anybody knows now that you trust me, and the more people trust a key, the more you can be sure that the key really belongs to its owner. Regards/MfG, Christian Weiske -- XMMS is playing now: Madonna - I'm So Stupid

Attachment: [application/pgp-signature] OpenPGP digital signature signature.asc