1

As far as I understand, the only purpose of PGP signatures is to prove your identity. Assuming your email account is secure and has 2FA, haven't you already proven your identity by sending an email from that address?

1 Answer 1

0

Assuming your email account is secure and has 2FA, haven't you already proven your identity by sending an email from that address?

With 2FA or any other kind of authentication you have proven your identity only to the mail server you use to send the mail, but not to the recipient of the mail. PGP signatures are instead to prove that you have send this mail (or at least that you are in the possession of the private key associated with the mail address) to the recipient of the mail.

Even if the recipient would trust your mail provider it still might be possible that this mail wasn't send using this provider in the first place, since senders can often easily spoofed. PGP signatures help also in this case to prove the real sender.

Not that this kind of similar to use of TLS for encrypting the mail vs. PGP or S/MIME encrypted mail. TLS only protects the mail against sniffing and modification between the various hops, i.e. sender to sender side mail server ... recipient side mail server to recipient. Sender to recipient confidentiality and integrity can not be achieved this way, but one would need PGP or S/MIME encryption done by the sender for this.

You must log in to answer this question.