Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Is there any point in signing an OpenPGP public key that has not been uploaded to a key server? In other words: does anyone except person A who signs person B's public key notice that the signing has taken place?

Background: since I haven't decided to upload my public key to a key server yet, I'm wondering if there's any point in asking friends to sign my key.

share|improve this question

1 Answer 1

up vote 1 down vote accepted

Web of trust? Instead of using a centralized, public key server, you and your friends could be exchanging key files directly. In which case the added signatures would be doing something.

However, if you are going to sign it, and then leave the file on your hard drive then you are correct that it doesn't do much good to others (though I think the GNOME Keyring gives some sort of priority to keys that you've signed).

share|improve this answer
    
Does that mean, after they sign it they have to send me (and potentially other friends) my public key with their added signature? By encrypte mail for example? –  docendo discimus 6 hours ago
    
@docendodiscimus I don't have a PGP to play with here, but I think you can export a signed version of someone else's certificate to a file. –  Mike Ounsworth 4 hours ago

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.