What is the difference between signing a user ID and a whole Key ? Which behavior is the best as to signing user IDs and Keys ? How and when to use "Local signatures" (non exportable) ?

(I was told any keys except for people I really know. However I can trust some people without knowing them in real life.)

My system seems to only fully accept keys I signed myself, otherwise it displays a warning that the public key validity is unknown. The keys are imported from servers and multiply signed by other people.

Thanks for your answers

1 Answer 1


Signatures on UIDs are used to acknowledge trust on other people's identity. If you sign another key's UID, you acknowledge you're sure about this identity.

Signatures on keys are used to bind subkeys and UIDs to your primary key. They're not issued to other keys.

Local signatures are signatures that will not get exported. For example, when syncing a key with keyservers or exporting using gpg --export. They're helpful if

  • You want to put trust on a key, but not tell anybody about it (eg. you're afraid of government knowing about some relation)
  • You want to put trust on a key, but aren't too sure about it (eg. for private package repositories -- you will realize when a key changes, but haven't been able to verify it in a secure manner)

OpenPGP/GnuPG trust model: If you want to make use of the web of trust (thus also have GnuPG trust the identities of the "friends of your friends"), you need to give another kind of trust into your friends: trust in their ability and reliability for verifying other's identities. This can be changed by using the trust command in gpg --edit-key.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.