Re: How can I have my GPG public key signed by a CA?

Quoting Akkana Peck ([email protected]):

> I've been to a couple of keysigning parties. (Ted T'so might even
> have been there. :-) But later, when someone sent me a signed email
> and I tried to verify it, that didn't help; I guess your key has to
> be on the same keyserver as the other person's key, or something.

The 'something' is a valid attestation chain in the PGP web of trust.
Keyservers are just conveniences for storing keys and signatures of 
keys.

Let's say you'd been to a keysigning I also attended some years ago. 
You saw my photo ID and heard me say that the key with a particular hash
value is mine, and thus decided to sign it.  

Years before that, I attended a keysigning with Marc Merlin, at the end
of which I decided I had enough validation information to sign Marc's
key.  Marc on some other occasion attended a keysigning with Drew
Streib, and signed his key.  Drew attended a separate keysigning that
included Ted T'so, and signed his key.

Today, you got an e-mail that's claimed to be cryptographically signed
by Ted T'so as sender.  You'd like to verify that.  On the surface of
things, it would appear to be a problem that you've never validated
Ted's key, so you might imagine you lack the ability, _but_ Ted's key 
is vouched for by Drew's key, which is vouched for by Marc's key, which
is vouched for by my key, which you validated at the keysigning we
attended some years ago.  Therefore, through the web of trust, you
indeed are able to validate Ted's key (or detect the signature as a
forgery), and your gpg key database has all the information to do so
automagically.

-- 
Cheers,        There's no theorem like Bayes's Theorem, like no theorem we know.
Rick Moen      Everything about it is appealing, everything about it is a wow.
rick@linux     Let out all that a-priori feeling, you've been concealing,
mafia.com      right up to now.   -- G.E.P. Box (w/apologies to Irving Berlin)