When viewing a key record in a public key server, such as this one, there are lots of keywords used: sig, sig3, exp3, Policy, sbind…). I understand that "sig" probably means a signature, but what's the difference between a "sig" and a "sig3" and a "sbind"? And what exactly is a "Policy" record?
In OpenPGP, signatures are used not only for documents, but also for certifications between primary keys with different levels of trust (
sig3; as hex codes
0x13 in this order) and several more internal stuff.
Signatures are also very important for binding subkeys to primary keys (and the other way round): these are displayed as
sbind signatures by key servers, and a simple
sig by GnuPG, and have signature types
0x19 in OpenPGP. User IDs are bound by "normal" certification signatures, also called self-signatures or selfsigs.
If for any reason you want to undo a signature, this is generally not possible (you cannot delete anything from the key server network). Instead, you again issue another kind of signature, a revocation of a key (
0x20), revocation of a subkey (
0x28) or revocation of a certificate (
0x30). All of those will be displayed as
revok by most key servers, and
rev by GnuPG.
A certification policy displayed with the key word
Policy drops out of this list, a little bit, as it does not denote another signature type, but is a signature subpacket describing a so-called certification policy. I already left a more detailed description in "What are you saying when you sign a PGP key?". Notations also describe a certification, and could for example be used to describe how the signer identified the signee.
The signature types are defined in RFC 4880, OpenPGP, 5.2.1. Signature Types, signature subpackets only a little bit further down in the same document.
There is a pretty good write up about PGP at Wikipedia.
According to the GPG manual (pgp for linux) under
The status of the verification is indicated by a flag directly following the "sig" tag...
So, looking at that:
Sig3means that another user has personally checked the fingerprint or key.
- If it says
Sigonly the means another user hasn't personally checked [the] fingerprint or key. (They're not vouched for.)
sbind is the time where the username was bound to the key. Basically when the record was created. This may be impacted by a policy.
revok is where the binding was revoked, so the key is no longer valid.
Policy is a specific user's policy in regard to how they'll exchange communications, their terms for contact, (and how they won't).