I have created a master key with two subkeys: one for signing and the other for encryption. Finally, I have exported the two subkeys to a new machine.

How can I tell the new machine to consider the master as "ultimate", even if it is absent from the machine? Does it matter?


You can set every key to ultimate trust through opening the key edit command line

gpg --edit-key [key-id]

and running the trust command. You will now be prompted to select the trust level:

Please decide how far you trust this user to correctly verify other users' keys
(by looking at passports, checking fingerprints from different sources, etc.)

  1 = I don't know or won't say
  2 = I do NOT trust
  3 = I trust marginally
  4 = I trust fully
  5 = I trust ultimately
  m = back to the main menu

Your decision? 

Obviously, 5 will be the proper decision to achieve ultimate trust. Finally, save to commit the changes and exit GnuPG. The same commands apply to both GnuPG 1.4 and GnuPG 2 (and newer).

Ultimate enables a key to introduce trust in the OpenPGP web of trust, with other words all ultimately trusted keys act as a starting point for trust paths. You should set your own keys to ultimate trust, but usually will not do so for other's.

| improve this answer | |
  • Minor note: it seems that save is not necessary, giving 'Key not changed so no update needed.' – David Oliver May 12 at 13:36
  • You're right, in fact this does not really edit the key, but the trust database which does not seem to require the save command. – Jens Erat May 12 at 20:01

Here is how to automate this (gpg --edit-key; trust; 5; save) for newly imported keys, effectively importing them as ultimately trusted.

$ gpg --import <key.asc
$ (echo 5; echo y; echo save) |
  gpg --command-fd 0 --no-tty --no-greeting -q --edit-key "$(
  gpg --list-packets <key.asc |
  awk '$1=="keyid:"{print$2;exit}')" trust 
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.