>... by encouraging “key signing parties”, and by creating a “web of trust” where keys depend on other keys. Welcome to the 90s. Does anyone actually ever do t

>... by encouraging “key signing parties”, and by creating a “web of trust” where keys depend on other keys. Welcome to the 90s. Does anyone actually ever do this sort of thing? Now you just aim your phone at a QR code on another phones screen. Times have changed... > Long term keys are almost never what you want. Long term keys represent long term identities. So, yes, you do want that. PGP has subkeys that you can revoke whenever you want thus preserving your identity. I can't think of of any other system that supports this in such a straightforward way. Your phone gets owned and you basically lose everything. If you keep your master PGP key on a more secure device you are still in business...