When one desires to share their public key openly, besides sharing just the key itself:
- How does one verify that the key belongs to who it claims to be owned by?
- What is the use case of the key's fingerprint?
- Is there a benefit to create a detached signature of the key to verify it was signed by the same person who created it? Is there a trust advantage to this?
The process for example:
# sender exports their public key gpg -o key.asc -a --export USER-ID # sender creates detached signature of public key gpg -o key.sig.asc -b -a key.asc # recipient verifies signature of sender's public key gpg --verify key.sig.asc key.asc
Are there any other things that can be done to verify the public key wasn't made with an ill intent?