In public key cryptography, the key is usually a key pair, consisting of a public key and a private key, and it is what you do encryption, decryption, signing, and verification with.
"A key certificate is an assertion that a certain key belongs to a certain entity" PGP lecture.
To illustrate what each key does, and to see an example of why one would both encrypt and sign, consider Snowden (S) and Greenwald (G):
Each of them creates their own key pair, and they publish their respective public keys.
Assume (for now) that the public keys are trustworthy.
Say S wants to send a message to G. To do that:
- S looks for G's public key.
- S encrypts the message using G's public key.
- S signs the encrypted message with his own private key.
G receives an encrypted signed message. The untrusted email header says it is from S.
- G looks for S's public key.
- G verifies the signature using S's public key. Now, G is convinced message is from S.
- G decrypts message using his own private key.
Note that signature and encryption are performed using different keys (by S). Without the signature, G would still be able to decrypt it, but he would not be convinced the message is really from S.
The whole scheme relies on the assumption that public keys are trustworthy. Otherwise, for instance, the spook K might publish a key with G's name and intercept G's email, so that when S sends the message, K decrypts it instead of G. This is where key certificates come into play.
However-however-however! This whole public key cryptography is only useful to implement secure communication between a trusted and an untrusted party. E.g., from G's pov, he does not trust S at the time when S wants to send him a message. Then: public key crypto enables G to receive encrypted messages meant only for him from an untrusted sender S.
If there are no untrusted parties in your scheme, there is no need for all this stuff. Instead, you and your boss should agree on a strong key/passphrase. Then, you could encrypt the message with traditional symmetric encryption using that shared key with gpg --symmetric --armor, and he could decrypt it with gpg --decrypt. This is how the command lines would look like. GUI and integration of GPG in email clients would be another topic.
