Can a new signature be added to an already signed message?

Question

Suppose Bob receives a clear-signed message from Alice. Bob wants to add his own signature to this signed message, because he has verified the message contents and wants his friends (network of trust) know the message is authentic. But Bob also wants to leave Alice's signature so that the message keeps its authenticity for her network of trust.

I know gpg can sign a single message with multiple keys at once (gpg --clear-sign -u key1 -u key2), but can you add a signature after signing and if so, is gpg capable of doing that? If not is it because it's against the PGP specification and why?

Answer 1

Bob can create a detached signature, and distribute that along with the message.

This can be done with or without leaving the original signature in place in the message that is being signed. With a cleartext signature, the signature from Alice could also be stripped from the message and left as a detached signature, if desired.

With GnuPG, --detach-sign or -b can be used to create a detached signature, whereas --sign or -s creates a signed message, or --clear-sign or --clearsign creates a cleartext signature.

Bob could also in principle clearsign the already clearsigned message, but that quickly gets ugly.

If the original plan is for multiple users to independently sign the message, then it is probably a good idea to have each user make a detached signature, then distribute everything together.