This is a question about usage of Web of Trust.
Let's suppose I've just generated a key pair and attended one or two Key Signing Parties. That gave me ~10 signatures on my public key, some of which belong to OpenPGP activists (so I'm reasonably sure that now my key belongs to the "strong set" in the worldwide web of trust). So, I've published my key to hkp://keys.gnupg.net
and fetched all of the attendees' keys into my local keyring.
At the same time, there are web-sites like http://pgp.cs.uu.nl/, which seem to automate "path finding in the web of trust" — that is, given my key fingerprint and some target key, it queries the key servers and shows all signature paths from my key to the target.
At the same time, its usage requires a big deal of human intervention. If/when I receive a signed message and wish to to verify the signature, I need to:
- go to that site (the PGP pathfinder);
- find the signature paths;
- import all participating keys to my local keyring;
- verify all these keys and signatures locally, so that I'm protected against rogue keyservers and/or pathfinders.
Another complication is that OpenPGP employs its own specific "trust model", which says that a signature path must fulfill some conditions (depth, trust levels, owner trust and so on) in order to be considered.
This is correct and good practice, but sometimes I want just to check the mere presence of signature paths, without imposing any restrictions on it (which is already better than nothing).
Again, I say that having a trust path is best, but in absence of that, having a signature path is at least somewhat better than having nothing.
Why there isn't a tool (perhaps integrated into GnuPG) which will do that work for me?