Sometimes it can be advantageous to use existing trust relationships in one certification world - X.509 or PGP - to create trust in the other world. At the lowest level I can always take an X.509 cert - say, a self-signed SSL or code signing certificate - and provide a detached signature with my PGP key. Someone who trusts my PGP key can then trust the X.509 cert, after verifying the signature.
This involves some manual steps but it is less cumbersome and less error-prone than telling people to compare long key fingerprints digit by digit. If they don't reduce the detailed comparison to a quick glance or skip the check altogether...
Are there any tools that support cross-certification directly - for example storing an 'alien' certificate as a property of a 'native' certificate - or indirectly? Any interesting papers that explore such uses?
ATM I'm investigating the problem per sé but where the shoe actually hurts is that the extortionate prices for code signing and SSL certificates (server and client) leave private people and small businesses in the lurch.