4 ms·
The trust values depend on the configuration of GnuPG and the trust model which is used. In the "web of trust" model, it is possible that one or several interme
by jnxx 10y ago
The trust values depend on the configuration of GnuPG and the trust model which is used. In the "web of trust" model, it is possible that one or several intermediaries sign a key and this key can become trusted. This is, of course, not perfect, but an approximation.
It is true that the usefulness of such indirect links quickly becomes much weaker than a direct link. What the tool tries to solve is to make an assessment for software, where direct signatures are often not practical.
- a3_nm 10y ago> it is possible that one or several intermediaries sign a key and this key can become trusted Yes, but as far as I understand this only occurs if you give them a trust rating (e.g., I marginally trust). If a key K is signed by multiple other keys which you know are valid but where you have no reason to trust the holders (and don't claim to trust them), then (as far as I understand) GnuPG will never infer that K is valid (and rightfully so).
- jnxx 10y agoHere is a relevant section of the gnupg manual: https://www.gnupg.org/gph/en/manual.html#AEN385 https://www.gnupg.org/gph/en/manual.html#AEN385 I think the concept was developed by Hal Finney; IIRC there is somewhere an email in which he describes it.
- a3_nm 10y agoThanks for the link. As far as I understand, it agrees with my interpretation.