2

My question is about openPGP and the GnuPG implementation in particular.

The web of trust idea seems to have your public keys signed by those who meticulously verify it. So when someone does this verifications, he could send my public key back to me carrying its signature so i can import it to merge the signature with those it already carries.

Is there a maximum number of signature for a given public key ?

If not : i am right to consider i should have as many signatures on my public keys as i can ?

Improve this question
1
  • Chances are, the maximum for GnuPG (not for the OpenPGP specification itself) is dictated by the type of integer used to represent the number of signatures. This means that it could easily be in the billions.
    – forest
    Mar 17, 2018 at 1:17

1 Answer 1

Reset to default
2

I don't believe there is a maximum limit on the number of signatures on your key. I'm sure there is one in GnuPG that is dictated by memory allocation restrictions, but it's probably an unreasonably high number that you're very unlikely to ever hit. I should know, as I help maintain the web of trust for the Linux kernel developers, and "too many signatures" is not a problem I've ever come across.

Getting as many signatures as possible is not the right goal to try to reach. There is no such thing as "The One True Web of Trust" -- each user of PGP spins their own individual "webs of trust" that they use to establish key validity for their correspondents. Having a lot of signatures on your key means nothing if none of the signing keys are trusted by the person with whom you are communicating.

Your goal should be to have a few signatures from important key members of each group of correspondents -- lead developers, heads of departments, or thought leaders in your online community.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .