In my keyring I have the public key of a former colleague. I have signed it, because I trusted that it was his key. I still do so, but the fact that he has left the company of course changes the nature of trust.
So basically what I want is:
- no new encryption operations should be possible with that key (especially important when they are executed by scripts)
- signatures before his leave date should be considered valid, signatures after that date should be considered invalid
The first thing I tried was editing the key (
--edit-key) and setting the trust to none (
2 = I do NOT trust). That does not even achieve the first requirement above. The opposite works if you have an unsigned key and set it to full trust. But obviously my signature is always stronger?
I know I could delete my signature (
delsig) but obviously that won't help with the second requirement.