GPG key trust after a signing party

Question

I might be totally misunderstanding the concept of web-of-trust, but imagine the following scenario: I generate my key, then go to a key signing party, and after, I import all the keys which fingerprint I have verified, and sign those. Now, this will make all those keys fully valid, but the default trust for each key will still be set to the default, i.e. "unknown". Which means that if I now import a new key, even if this new key has enough (*) signatures from those, it still won't be considered valid, because none of those keys is trusted.

Which means that for key signing parties to have some usefulness, we must set those keys' trust to at least marginally trusted. Right? Or am I making some mistake somewhere in my reasoning?

(*) - In GPG's default security model, i.e. one sig from a fully trusted key, or 3 from marginally trusted keys.

Answer 1

A (slightly) simplified way to think of it is:

1) You sign someone's key to say "I assert that this key belongs to the person identified".

2) You assign trust to someone's key to say "I believe this person is responsible enough to do number 1 well".

#1 is a public statement from you (your key) to the world. #2 is a private note in your own GPG setup.

The two don't necessarily go together. If you think someone makes terrible signatures (for example, doesn't check sufficiently before signing), then you may still sign their key (after all, you're not making a statement as to their reliability, just as to their identity), but you probably wouldn't want to assign trust to their key. In other words, you believe their key belongs to them, but you don't "trust" them to make good signatures on other people's keys.

At a keysigning party, it's quite common to be able to sign someone's key (you check some ID, verify their email address works via a cookie, and so on), but yet have no idea if the person is worth trusting to sign someone else's key. After all, in many cases, you've never even met them before.

Answer 2

Well, yes and no. Key validity is not to be underestimated -- everyone whose key you signed is now fully valid in your keyring and you can communicate with them using this direct trust. However, if you want to be able to use the actual web of trust, then yes, you will need to assign owner-trust to all or some of those keys. Without that step, the "web" part of the "web of trust" does not really kick in. Start with marginal owner-trust and assign full trust only to those people who you know will do a good job verifying someone's identity before signing keys.