When I verify a file signature I get the the following warning:
$ gpg --verify file.sig
gpg: Signature made So 01 Dez 2019 10:08:27 CET
gpg: using RSA key <Pierre's key ID>
gpg: Good signature from "Pierre <[email protected]>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner.
Primary key fingerprint: <Pierre's key fingerprint>
I have signed Pierre's key (with a certificate level check 1):
$ gpg --list-signatures [email protected] | grep andrew
sig 1 5E091391A98EBD4E 2019-10-22 Andrew 'raindev' Barchuk <[email protected]>
And my own key is marked as ultimately trusted:
$ gpg --list-keys 5E091391A98EBD4E
pub rsa2048 2017-10-19 [SC] [expires: 2021-10-21]
0954F96BC41612E2299383945E091391A98EBD4E
uid [ultimate] Andrew 'raindev' Barchuk <[email protected]>
sub rsa2048 2017-10-19 [E] [expires: 2021-10-21]
sub rsa2048 2017-10-19 [S] [expires: 2021-10-21]
To my understanding it's safe to trust the signature as it's made by a key I have signed. What's the reason I get the warning and how do I get rid of it?
