I have a service through SSL which gives the user a code for a specific reason. I want to sign the code with the web server's private key (
gpg --clearsign) and send the signed code along so that they can verify its origin after they leave my site.
Unfortunately I get the error:
gpg: WARNING: This key is not certified with a trusted signature! gpg: There is no indication that the signature belongs to the owner.
I roughly understand what it means, although I am unsure of a method to give my server's public key while maintaining trust.
Do I have to "sign" the public key that is exported (and then supplied to the user) with the user to whom it was exported?
What are some simple methods to provide this trust?
I've read about keyservers and frankly that is not really an option for me, I am unsure of how I can get this to work.