Is there any point in signing an OpenPGP public key that has not been uploaded to a key server? In other words: does anyone except person A who signs person B's public key notice that the signing has taken place?
Background: since I haven't decided to upload my public key to a key server yet, I'm wondering if there's any point in asking friends to sign my key.
Web of trust? Instead of using a centralized, public key server, you and your friends could be exchanging key files directly. In which case the added signatures would be doing something.
However, if you are going to sign it, and then leave the file on your hard drive then you are correct that it doesn't do much good to others (though I think the GNOME Keyring gives some sort of priority to keys that you've signed).
The whole OpenPGP web of trust idea is build around certifications (signatures of other keys) being publicly available, so other users can build trust paths on these. Keeping certifications private is surely legit, but will not help others (also contacting you).
If you only share your key among your friends, they could still make use of certifications you issued. If you also share it with everybody, also others might make (some) use of them when building trust paths, depending on their need of certainty and trust they put into you (possibly without knowing you).
Others could very well manually import your key (gpg --import [file]), sign it (gpg --edit-key [key-id]) and finally export it again (gpg --export [key-id] > [file]). Now the exported key contains your signature, and they can sent it back to you. When importing the file, the certification gets merged to the other one's on your key. If you export it again, you could distribute your public key together with all the certifications together in one file to everybody that wants to use your key. This is pretty much the same operation like fetching keys from a keyserver using gpg --recv-keys [key-id] and finally sent it back to them using gpg --send-keys [key-id], just that latter one is public and makes distributing the key easier.
Most people are used to upload keys after putting certifications on them (or they use some software that just mails back the certifications). At some point, somebody will forget about your request not to upload it and just do so, or simply upload his full keyring using gpg --send-keys (yes, that's possible!). Expect every shared OpenPGP key to be available on the key server network at some time, by creating an OpenPGP key and sharing it you in agree with it being shared on the key server network to some extend (without wanting to have this being an excuse to upload everything anyway, but it will happen and you should be aware about this).
