PGP & GPG

Managing GnuPG Keys 105

Signing a Key

Now that you know how to grab other people’s keys from a

keyserver, let’s hook those keys into our Web of Trust. First, of

course, you need to check the other person’s ID, confirm the

identity, and also note the email address and key fingerprint.

After you have confirmed this information, you need to sign

the public key, which involves checking the fingerprint of the

downloaded public key, digitally signing the key, and then

returning the key to the owner.

Checking Fingerprints

Let’s assume that you imported a key that looks like the other

person’s key. In this example, I’m considering signing my

friend Greg’