How do i decide whether to sign someones PGP public key? I was looking at some contact pages and they have a request for people to sign their public key. How serious of a commitment is it to sign someones public key?
You should really only sign someone's key if you actually know them, and you trust that the key is theirs.
When you sign it, you are saying that you checked them out, that you know it's their key.
You then figure out "would I trust this person to be as thorough as me in evaluating the identity of other people?" You might have friends who are careful, or people who you are acquainted with and hold a position of responsibility so you think they might be trustworthy, or they might be a complete stranger, so you wouldn't trust them with a burned out match. That's when you assign the level of trust.
A web page begging you to sign it could be someone trying to build a sock puppet, false identity, or even stealing someone else's identity. Worse, they could be collecting the identities of people who are gullible enough to sign a random key with no validation process.
You need to verify their identity. Normally this would require them you to have them show you two forms of identity validation (for instance an ID card and a driver's license) and by making them show you a document which determines that they actually live at their listed address ( a bill for electricity or water for instance).
For instance CAcert is a community driven certificate authority. They sometimes do signing parties: