Key signatures and the web of trust in GnuPG

An OpenPGP key carries one or more user IDs, usually a name and an email address. When you sign someone’s key, your software makes a signature over their public key and one of those user IDs, using your own private key. The message is: “I checked, and this key really belongs to this person.”

The standard (RFC 9580) has four kinds of certification. They range from “no particular claim about how well I checked” up to “I did substantial checking”. A certification says nothing about whether you like the person, agree with them or would lend them money. It is only about who owns the key.

People mix these up, but GnuPG keeps them apart:

• Validity is how sure you are that a key belongs to the person on it. GnuPG shows it in square brackets in key listings, for example [full] or [unknown].
• Owner trust is how far you rely on that person when they sign other people’s keys. You set it yourself. It lives in your local trust database (trustdb.gpg) and is not part of the key you publish.

So you can be completely sure that a key is your uncle’s (full validity) and still not trust him to check anyone else’s identity (no owner trust).

You do not have to do anything. The 1990s FAQ told PGP 2.x users to sign every user ID by hand. GnuPG now makes these self-signatures for you when you create a key, add a user ID or add a subkey. They tie each user ID and subkey to your primary key. Anyone can glue a fake user ID onto a copy of your key, but they cannot make your self-signature on it, so OpenPGP software will not accept that user ID as yours. In gpg --check-signatures output, self-signatures are marked [self-signature].

Compare the full fingerprint through a channel you already trust: in person, on a phone call where you know the voice, or on paper the person gives you. Do not rely on a key ID, a name in a keyserver search, or a fingerprint in the same email that brought the key. Anyone can forge those.

gpg --fingerprint alice@example.org

A version 4 key, the kind most people still have, has a 40-hex-digit fingerprint. Version 6 keys from RFC 9580 have longer, 64-digit ones. Check every digit, not just the last few. If you are signing a stranger’s key, for example at a signing party, also check an official photo ID that shows the name in the user ID. Never let anyone use your computer, or use theirs, to “quickly” sign a key: your private key and passphrase belong only on machines you control.

First import the key, then check the fingerprint as above. Then sign it by its full fingerprint:

gpg --quick-sign-key F135FBB3768D3CFC69D84DDC74C2EE549979B18B

To sign only some of the user IDs, list them after the fingerprint, for example "Alice Example <alice@example.org>". Without names, all user IDs are signed. The older interactive way, gpg --sign-key (or gpg --edit-key followed by sign), does the same with prompts. Check the result:

gpg --check-signatures alice@example.org

pub   ed25519 2026-11-04 [SC] [expires: 2029-11-03]
      F135FBB3768D3CFC69D84DDC74C2EE549979B18B
uid           [  full  ] Alice Example <alice@example.org>
sig!3        74C2EE549979B18B 2026-11-04  [self-signature]
sig!         F2C9F13D0062B815 2026-11-04  Test User <test@example.org>

The ! means the signature checked out. The digit after sig is the certification level, where one was set.

A normal signature is exportable: it goes with the key when you or the owner pass it on. A local signature, made with gpg --lsign-key or gpg --quick-lsign-key, only counts on your own computer. RFC 9580 says local certifications are removed when a key is exported. Use a local signature when you have convinced yourself a key is right, for example a software project’s release key whose fingerprint you checked on the project’s HTTPS site, but you do not want to make a public statement about it.

GnuPG can record how carefully you checked: 0 means no particular claim, 1 means you believe the key is the owner’s but did not check, 2 means casual checking, and 3 means extensive checking. By default GnuPG does not ask and uses level 0. Add ask-cert-level to gpg.conf if you want the prompt. Note that the default min-cert-level of 2 makes GnuPG ignore level 1 signatures when it works out validity. Level 0 signatures are always accepted.

Export the key, which now carries your signature, and send it to the owner. Ideally, encrypt the file to that same key and email it to the address in the user ID. Then only someone who controls both the address and the private key can use it.

gpg --armor --export F135FBB3768D3CFC69D84DDC74C2EE549979B18B > alice-signed.asc

The caff tool in the Debian/Ubuntu signing-party package automates this: it signs the key and mails the result by email. The owner imports the file with gpg --import and decides whether to publish it.

With the default pgp trust model, a key is valid if it is signed by you, or by enough other valid keys whose owners you trust:

• one signature from a key you trust fully (completes-needed 1), or
• three signatures from keys you trust marginally (marginals-needed 3),
• and the chain back to your own key is no longer than five steps (max-cert-depth 5).

Example: Bob’s key is signed by Carol, whom you trust fully and whose key you signed. Bob’s key is valid. If it is signed instead by Dan and Erin, whom you trust marginally, two out of three is not enough, and Bob’s key stays [marginal] until a third marginally trusted signature turns up.

gpg --edit-key carol@example.org
gpg> trust

  1 = I don't know or won't say
  2 = I do NOT trust
  3 = I trust marginally
  4 = I trust fully
  5 = I trust ultimately
  m = back to the main menu

Your decision? 3
gpg> quit

Give full trust only to people you know check fingerprints carefully before they sign. To back up these settings, run gpg --export-ownertrust > ownertrust.txt. Restore them with gpg --import-ownertrust.

You will see “ultimate” on your own keys. GnuPG sets it on every key you create, so anything you sign with them becomes valid. Never give ultimate trust to someone else’s key: that would let them make any key valid for you.

A trust signature (tsign in gpg --edit-key) certifies a key and at the same time says “I trust this key’s owner to certify others”. Level 1 makes the key a trusted introducer. Level 2 trusts it to name other introducers. RFC 9580 lets you add a regular expression that limits the trust to matching user IDs. For example, a company’s certification key could be trusted only for addresses ending in @example.com. Few people need trust signatures.

TOFU stands for Trust On First Use. GnuPG remembers the first key it sees for each email address. If a different key with the same address turns up later, it marks both as suspect and warns you. When you verify a message, it also shows how many messages that key has signed before. This catches the most common trick, a fake key for someone you write to often, without anyone signing anything. The combined model is still marked experimental. To use TOFU together with the web of trust, add this line to ~/.gnupg/gpg.conf:

trust-model tofu+pgp

With tofu+pgp, GnuPG works out a trust level under each model and uses the higher one. You can set a policy per key, for example after checking a fingerprint on the phone:

gpg --tofu-policy good F135FBB3768D3CFC69D84DDC74C2EE549979B18B

The policies are auto (the default), good, unknown, bad and ask.

In late June 2019, attackers attached tens of thousands of bogus certifications to the keys of two OpenPGP developers on the SKS keyserver network. LWN reported about 55,000 on one key, which grew to 17 MB, and nearly 150,000 on the other. SKS servers never delete anything, so the junk could not be removed, and GnuPG choked when it imported these keys.

GnuPG 2.2.17 (July 2019) responded by ignoring all key signatures received from keyservers. The defaults self-sigs-only and import-clean in keyserver-options still do this today. keys.openpgp.org, launched in June 2019, does not publish third-party certifications by default either. The one exception is certifications the key owner has explicitly marked as attested. See Keyserver questions for more.

The web of trust is smaller now, but it still works when you get signatures directly: the owner sends you their signed key, or a group hands out its own keyring file. Most users now check keys with fingerprints, keys published under their own email domain (see Web Key Directory), and TOFU.

Participants send their fingerprints to an organizer beforehand. At the meeting, each person reads out or confirms their own fingerprint and shows ID, and the others tick off what they have checked on a printed list. Nobody signs anything on the spot. Back home, each person signs only the keys they checked, then sends the signatures back, for example with caff. The signing-party package also has gpg-key2ps, which prints fingerprint slips to hand out. Bring paper and ID, not your private key.

Run gpg --edit-key on the other person’s key and use revsig. GnuPG offers each signature you made on it for revocation. Save, export the key and send it to the owner, as with a new signature. See Revoking a key for revoking your own key.