PGP & GPG

Other OpenPGP Considerations 157

When you sign someone’s key, you are not only validating

that person’s identity for your own use but you are also publicly

affirming that you have verified the person’s identity. A person

who tricks someone else into signing a key generated for a

fraudulent identity can successfully hook into the Web of Trust

and gain the confidence of others.

Remember, you can use someone else’s public key without

signing it. If I were to send you email, you could import my

public key and use it to read mail encrypted with the match-

ing private key. You would have no guarantee that I was who I

claimed to be, but you would have a ...