Recently I got a CAcert Assurance and discovered that I can get my PGP key signed by CAcert key. After I got their signature, CAcert website suggested that I sign their key, too.

Question: CAcert status aside, what are the pros and cons of blindly signing an arbitrary key?

migrated from stackoverflow.com Jul 23 '14 at 11:33

This question came from our site for professional and enthusiast programmers.


Signing Keys Without Meeting Somebody

In principle, you can sign any key you want for whatever reasons. Nobody is there to enforce anything, but probably people will realize after a while and distrust you.

You should never sign keys that you could not verify in any fashion. Signing is a statement that you're sure about the other's identity – but how should you?

Regarding CAcert: if you're already able to verify their root certificate (for HTTPs), you can read their OpenPGP fingerprint on their website. If that's fine for you for signing their key, and the fingerprint on the website matches the one you downloaded, do so.

If you're not sure about their root certificate, and it is not included by default in your distribution, you might want to keep the uppermost part of the assurance form, which contains the fingerprints (the assurer is allowed and prompted to hand it to you!). It is not reasonable to assume that somebody is able to tamper with the assurance form the other member printed from their site, and at the same time tampering the CAcert web site.

Certificate Authority in OpenPGP Web of Trust

CAcert is the largest certificate authority in the OpenPGP web of trust, they have a very central position. If you sign and trust it (and thus trust in their methods on signing other CAcert user's keys), you can extend the part of the OpenPGP web of trust which you can validate (usually by magnitudes). Doing so is pretty much the same like adding their root certificate to your browser.

If you do not want to publicly sign their key, you can use a local signature that will not get uploaded to key servers.

My own Opinion

I did sign and trust their key, as I want to take advantage of the huge number of keys I can validate now and potentially put more trust in CAcert's methods of assurance than what most people do at OpenPGP keysignings.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy