The Web of Trust 85
Let’s assume that a hypothetical new employee (we’ll call
him Matt) has just generated his keypair and needs me to sign
it. I also want him to sign my keypair; not only will this expand
his Web of Trust but to sign my key he must also add my key
to his keyring. This means that he will be able to verify email
that I send him. Matt produces a piece of paper with his keyid
and fingerprint, and informs me that his public key is on a key-
server. He also has two pieces of government-issued ID.
Now, I know Matt. I hired him. I’ve already done a certain
amount of identity verification on him by doing a background
check, filing paperwork with the state, and so on. If he’s
attempting to deceive me about his identity, he’s doing it with ...