I've made a signing key with GPG and I would like to have it verified since GPG displays a warning whenever a file signed with my key is verified. I've heard of Let's Encrypt but it only talks about HTTPS. Can I use it on my signing key?
GPG and Browsers trust certificates in fundamentally different ways.
How do Browsers do it?
Browsers need a set of trusted root certificates. These either come bundled with the browser, or the browser relies on the root certificates that the OS provides.
When trying to validate a certificate, the browser checks first if the certificate matches what the browser is trying to access (e.g. if a browser tries to access security.stackexchange.com, does the certificate claim to be from security.stackexchange.com?) and then checks who signed that certificate. Then the browser checks that certificate, all the way up to the root. If the root is found in the browser's trust store, the certificate is considered valid.
How does GPG do it?
The above mentioned approach requires trusting certain third parties not to issue bogus certificates. Instead, GPG tries to distribute trust among peers. The way this works is that you generate a key that originally nobody trusts. You then share your key with your peers, and your peers then sign your key. They can choose the following options:
- Marginal trust: This option means that you trust that key a little bit, but not necessarily completely. This should be used if you got that key through some means, but can't actually 100% verify that the key is legitimate.
- Full trust: You trust that the key belongs to whoever you believe it to belong, and you also trust that the person will make sane signing decisions.
- Ultimate trust: This is for your own keys. You will trust everything these keys do, and everything signed by these keys.
How do I fix this weird GPG error?
First of all, your friend needs to verify through some means that the public key they received is actually yours. This can be done through any channel which you think is unlikely to be compromised - most favorably in person.
Then, your friend should sign your key. It doesn't matter what trust they give it, just that they signed it. As a result, your friend's GPG installation will consider the key trustworthy.
Why would you even do such a complicated thing?
GPG is notoriously user-unfriendly, which is likely a reason why it is not widely used outside of enthusiast circles. The core idea behind it, however, is that solid trust established by meeting in person and exchanging keys is very very difficult to subvert. No compromised CA could get you to trust a key which you did not manually set to trust.
If this is something you are worried about is a different story. If you want to learn more about GPG's trust model, this article gives some good insights.