When you sign a PGP/GPG key, what exactly are you saying to everyone who sees your signature? Are you validating the person, or the email address?
To explain what I mean, take the following two examples:
Validating the person: "I trust that the key
0x559E3EE8 belongs to Bob in accounting; he personally handed me a piece of paper with that public key over lunch. I don't know what Bob's email address is, but if he lists it as one of his UIDs in his key, I'm fairly sure it belongs to him.
Validating the email address (UID): "I trust that the key
0x559E3EE8 belongs to
[email protected]; I don't know who he is in real life, but we have sent encrypted emails back and forth, and I definitely know that he can decrypt and read the emails I send him, as he sometimes quotes things I wrote to him. I can also be very certain that there is no man in the middle between my computer and his mail server."