Re: How can I have my GPG public key signed by a CA?

Rick Moen writes:
> Today, you got an e-mail that's claimed to be cryptographically signed
> by Ted T'so as sender.  You'd like to verify that.  On the surface of
> things, it would appear to be a problem that you've never validated
> Ted's key, so you might imagine you lack the ability, _but_ Ted's key 
> is vouched for by Drew's key, which is vouched for by Marc's key, which
> is vouched for by my key, which you validated at the keysigning we
> attended some years ago.  Therefore, through the web of trust, you
> indeed are able to validate Ted's key (or detect the signature as a
> forgery),

That all was how I thought it was supposed to work when I went to
the keysigning, but later, when I tried to use it, ...

> and your gpg key database has all the information to do so
> automagically.

... that was the part that didn't work. And since it's supposed to
be automagic, nobody seemed to write about what to do if it didn't
work, or how to debug the process.

Same thing happened when I tried setting up mutt to verify the keys
some people append as attachments. It never worked because they were
never on whatever keyserver mutt was checking.

There may be better howtos written now, though I'm thinking maybe
not, since I'm not having much luck finding anything that might help
answer questions like "Who has signed my key?", "Whose keys have I
signed?" and "What keyserver(s) have my key?" This of course may
just be me failing at google-fu. I tried gpg --check-sigs and
--list-sigs, but as far as I can tell from the man page, those are
just showing keys I've seen at some point in the past that have
signatures from anyone. (FWIW, it lists you, Rick, but not Ted.)

        ...Akkana