PGP keys varying only in attached signatures

Question

Here is a few questions revolving around the same core problem.

1. Let's say I generate a PGP keypair.
2. I now get the keypair signed by person A at signing party X.
3. In the evening, I give my now-signed public key to person B.
4. Next day I get my public key signed by person C at signing party Y.
5. In the evening, I give my now-signed public key to person D.
   • Person B and person D now both have my public key, but different versions (I don't know if version is the right word).
6. Imagine a person E obtains my public key from both person B and person D.

How does person E determine which one to use?

Similar, I could start by making two copies of my public key and then get them signed by two mutually different groups of people.

Again, how can a later-coming person's PGP software determine which one to use?

I wonder if it can automatically merge the signatures in to an all-containing key, if and only if the list of attached signatures need to be self-signed by my private key.

Finally, do people keep uploading their keys to keyservers as they get signed by more and more people?

Answer 1

A public key like published on the keyservers actually consists of a set of single packets. One is your public key, then there are user IDs, and the incoming signatures from other keys (and some more stuff which is not important here).

How does person E determine which one to use? Again, how later-coming person's PGP software determine which one to use?

As stated above, the key is the same, just the signature packets are differents. You can have a look at them using gpg --listpackets [file], also have a look at this answer on how to view OpenPGP key files. I strongly recommend to have a look at the rather lengthy output to understand what's going on.

When "updating" the key (gpg --recv-keys [key]) from a key server, all the new packages will get merged with the ones already on the disk. The keys do not "branch" in any kind. Imagine this as the union of signatures sets. This can also be done by exporting and importing using gpg --import [file].

Finally, do people keep uploading the[ir] keys to keyservers as they get signed by more and more people?

I hope I got your question right, and you want to know whether people upload their key from time to time to distribute their new signatures using gpg --send-keys [key]. Then, the answer is a clear "yes and no". Most do, a lot only now and then, and some not at all.