> Kernel.org web of trust PGP keys used by members of kernel.org are cross-signed by other members of the Linux kernel development community (and, frequently, b

> Kernel.org web of trust PGP keys used by members of kernel.org are cross-signed by other members of the Linux kernel development community (and, frequently, by many other people). If you wanted to verify the validity of any key belonging to a member of kernel.org, you could review the list of signatures on their public key and then make a decision whether you trust that key or not. See the Wikipedia article on the subject of the Web of Trust. https://www.kernel.org/signature.html https://www.kernel.org/signature.html Looks like the kernel.org folks actually use the web of trust model.