Part of the web of trust of GPG is the use of Keyservers to publish/distribute versions of public keys. It's encouraged of course to sign public keys you trust so the the web may grow.

How does a Keyserver deal with the following scenario:

  • I sign a slightly older version of a public key
  • I try to upload and distribute that
  • The Keyserver's version already has another or multiple additional sigs to my version that I'm uploading

How is that conflict handled?

Or is it simply that sigs are really just extra metadata, that can be added to a key in a modular fashion. i.e. you can 'combine' all the sigs into one key block.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.