OpenPGP and Email 121
One possibility is to use only the corporate PGP keyserver
and only correspond with people who use that keyserver. PGP
Corporation’s keyserver signs public keys after it verifies the
email address they’re attached to.
However, OpenPGP is called “open” because anyone can
implement it, and you can’t control who will send you email
any more than you can control who sends you postcards. I cor-
respond with people all over the world who use OpenPGP, and
quite a few have public keys that aren’t even vaguely hooked
into my Web of Trust. How can I trust them? Here are my three
choices:
• Expand my Web of Trust
• Trace the Web of Trust to that person
• Use the key but limit my trust of the sender
Expanding Your Web of Trust
The most ...