I observed today that Thunderbird/Enigmail (24.2.0/1.6) does not allow me to select a key for encrypting mails to one of the addresses associated with the key, even though others work. Help sites claim that the reason must be a lack of user trust, but the key is trusted (fully).

I think I tracked down the issue to some extent; gpg --edit-key ABABABAB outputs something of the form:

pub  1024D/ABABABAB  created: 1970-01-01  expires: never       usage: SCA 
                    trust: full          validity: full
sub  1024g/BCBCBCBC  created: 1970-01-01  expires: never       usage: E   
[ unknown] (1). John Doe <[email protected]>
[  full  ] (2)  John Doe <[email protected]>

Sending to j_doe works, to doe not so much. What might be happening is that Enigmail checks the trust value for the specific user id, not the whole key (only when sending, though; key management happily announces "trusted" everywhere).

How do I change the trust value of uid (1)? I tried (re)setting trust of the whole key and selecting the subkey and/or the uid and settings its trust (which does not even seem to be feature) but unknown does not go away.

I use gpg (GnuPG) 1.4.12 on a Debian GNU/Linux variant.

1 Answer 1


There is a difference between trust and validity. Trust allows keys to validate other keys (so its outgoing signatures extend your partition of the web of trust). Trust means that you trust in the key's owner to reasonably sign other keys. A key is valid if it is in your partition of the web of trust: signed by you, or has acceptable trust paths from your key.

Trust is key based, while signatures are (usually) UID based. Looking at the given output, you probably signed John Doe <[email protected]> some time ago, but not John Doe <[email protected]>.

Sign that UID to make it valid. The trust on the key does not matter here.

  • 1
    Both your analysis of the situation (the UID was added after I signed the key) and the solution are accurate, thanks! (In my defense, Enigmail does in no place indicate that a signature is needed for using a key for encryption [is that standard?] and it did also not let me re-sign the key, and neither did Seahorse.)
    – Raphael
    Mar 14, 2014 at 14:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .