How can I use `caff` to sign some keys at cert-level 2 and some at cert-level 3?

Question

I participated in two key sharing parties last week. Upon return, I tried to certify the keys of the participants that I had verified. For creating the signatures, I use caff from the signing-party package. I only verified that key, email address and UID belong together for some participants, others showed me their ID additionally. I want to issue signatures of cert-level 2 for the former, and cert-level 3 for the ones whose IDs I checked.

I have a separate keyring file for each of the events. I used caff -R --key-file <fp1 fp2…fpn>, to ensure that the keys would be imported from the files that were shared at the event. I tried:

• Just using caff and when asked whether I want to sign for a specific UID:
  I was not asked for the certification level
• Checking whether I can add --ask-cert-level to the caff call:
  couldn't find anything to that effect in the man and didn't succeed when tried
• Declining to sign when asked whether I want to sign a UID by caff, but then adding a signature manually while in the key-edit mode before saving:
  I could not figure out how to set a cert-level in the gpg --edit-key dialogue
• Signing the key with --ask-for-cert in the event-specific key-ring before calling caff on it:
  while caff did recognize that I had previously signed some other keys in the ring and told me that there was nothing to do for me, it did not tell me that for the keys I had manually created a sig3 on before calling caff.

Is there a way to use caff to create some sig2 and some sig3 on different keys, or to do two separate runs to create sig2 on one set of fingerprints, then do another run to create sig3 for other fingerprints? I am okay with manually creating the sig3s, but I would like to make use of the automatic export by UID, encryption and mailing that caff performs.

Answer 1

I solved my problem through the discovery of pius, a newer python-based PGP singing tool. Pius asks explicitly what cert-level to apply for each key and was available directly from the package manager. It also sidestepped the horrible requirement of setting up a MTA by sending the signed public keys via SMTP.