Is there any point in signing an OpenPGP public key that has not been uploaded to a key server? In other words: does anyone except person A who signs person B's public key notice that the signing has taken place?

Background: since I haven't decided to upload my public key to a key server yet, I'm wondering if there's any point in asking friends to sign my key.

2 Answers 2


Web of trust? Instead of using a centralized, public key server, you and your friends could be exchanging key files directly. In which case the added signatures would be doing something.

However, if you are going to sign it, and then leave the file on your hard drive then you are correct that it doesn't do much good to others (though I think the GNOME Keyring gives some sort of priority to keys that you've signed).

  • Does that mean, after they sign it they have to send me (and potentially other friends) my public key with their added signature? By encrypte mail for example? Jun 3, 2015 at 16:03
  • @docendodiscimus I don't have a PGP to play with here, but I think you can export a signed version of someone else's certificate to a file. Jun 3, 2015 at 17:25

Keeping Certifications Private or Public

The whole OpenPGP web of trust idea is build around certifications (signatures of other keys) being publicly available, so other users can build trust paths on these. Keeping certifications private is surely legit, but will not help others (also contacting you).

If you only share your key among your friends, they could still make use of certifications you issued. If you also share it with everybody, also others might make (some) use of them when building trust paths, depending on their need of certainty and trust they put into you (possibly without knowing you).

Procedure for Signing Keys not on the Keyserver Network

Others could very well manually import your key (gpg --import [file]), sign it (gpg --edit-key [key-id]) and finally export it again (gpg --export [key-id] > [file]). Now the exported key contains your signature, and they can sent it back to you. When importing the file, the certification gets merged to the other one's on your key. If you export it again, you could distribute your public key together with all the certifications together in one file to everybody that wants to use your key. This is pretty much the same operation like fetching keys from a keyserver using gpg --recv-keys [key-id] and finally sent it back to them using gpg --send-keys [key-id], just that latter one is public and makes distributing the key easier.

Probably Somebody Will Upload it by Accident

Most people are used to upload keys after putting certifications on them (or they use some software that just mails back the certifications). At some point, somebody will forget about your request not to upload it and just do so, or simply upload his full keyring using gpg --send-keys (yes, that's possible!). Expect every shared OpenPGP key to be available on the key server network at some time, by creating an OpenPGP key and sharing it you in agree with it being shared on the key server network to some extend (without wanting to have this being an excuse to upload everything anyway, but it will happen and you should be aware about this).

  • Thanks for your detailed answer, certainly helpful! As you can imagine I'm just getting started with this whole topic. Jun 4, 2015 at 14:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .