[PGP] can get paralyzed by excessive analness. — Phil Zimmermann
I am in the process of building my own web of trust. That is, I want people (PGP users…) to be—fairly—sure that, by using my public PGP key, they are actually communicating with the real me (which can be achieved by checking who signed my public key, and if they seem trustworthy, then I could be too).
When my [public] key will have enough trusted signatures, my own signatures on other people’s keys will have much more sense. Bad-case example scenario: I sign Mallory’s (a bad guy) key, then one year later, my key is signed by, say, a Debian maintainer (a very trusted guy). If that guy is trusted and signed my key, then it means I am trusted too; and if I am trusted too, it means that Mallory is trusted too, right?
I sign other people’s public keys with the following GPG command (on Linux):
gpg --ask-cert-level \ --cert-policy-url http://diti.me/pgp/ \ --sign-key 0xB16B00B5
The above command enables me to sign the 0xB16B00B5 key with a policy URL (giving out info about how I verify and sign the keys) and allows me to choose:
How carefully have you verified the key you are about to sign actually belongs to the person named above? If you don't know what to answer, enter "0". (0) I will not answer. (default) (1) I have not checked at all. (2) I have done casual checking. (3) I have done very careful checking.
The question is: Can I sign, with level 3, the key of a friend I have been knowing for several years? Needless to say I trust him (& his seriousness in keysigning), and would still perform careful checking (extended questioning, adding a TXT field in his domain name’s records, and so on?).
Phil Zimmermann wanted people to use PGP, not just geeks. I want to avoid what he calls “excessive analness,” whilst still being considered as a serious person (for the web of trust matters). As such, I would like to mix the two together: to simplify the verification process for friends whose I can accurately verify the identity and key, while not breaking my WoT.
Hopefully my question and concerns make sense.