Re: How can I have my GPG public key signed by a CA?

Quoting Akkana Peck ([email protected]):
> Rick Moen writes:

> > and your gpg key database has all the information to do so
> > automagically.
> 
> ... that was the part that didn't work. And since it's supposed to
> be automagic, nobody seemed to write about what to do if it didn't
> work, or how to debug the process.

I was being outrageously intellectually lazy when I said it's
automagical.  Truthfully, I'd completely forgotten the messy details --
and as I sit here, am groping fitfully to remember them, and idly 
Web searching for someone having done the heavy lifting, which finds me
pages like https://wiki.gnupg.org/WebOfTrust .

Obviously if Marc signed Ted's key at a keysigning party but you weren't
even aware of the keysigning, you probably wouldn't easily come by
Marc's digital signature.  IIRC (and this is where I try to reconstruct
fading memory), Marc's signature might arrive at you because you
received a mail purporting to be from Ted, and you seek out Ted's key
from places including public keyservers.  Ted's key gets downloaded to
your keyring, but also it gets accompanied by all digital signatures
then on-record of Ted's key by others, including Marc's.  Your copy of
gpg inscribes those digital signatures into your local gpg database
along with the key.  

As mentioned on the above-cited Web page, your decisions for your local
trustDB are also relevant, in deciding (based on your experience in
keysigning parties and the like) the degree to which you trust
'introducers' of strangers' keys, e.g., you might at points in the past
have decided you think Marc, me, Drew Strieb, or other relevant parties
who claim to be able to attest to other people's keys (including
possibly Ted's) are not wholly flaky peoople and their word can be
relied upon.

Now, in your case, I obviously don't have enough data to judge why this
model didn't work out to vet a gpg signature's authenticity.  It would
be flippant to say 'Attend more keysigning parties', but I fear that
this probably would be the standard answer.  The whole web of trust
model works best among reasonably well-connected people (such as the set
of Debian developers) and outliers in the sense of 'I know a person who
knows a person'.  The model shows design weaknesses if you expect it to
reach arbitrary strangers.

In that regard, someone asked about Keybase.io.  It does appear to be a
third-party effort to expand the gpg web of trust's reach.  As I'm only
now reading about it (except to say that I'm personally very _not_ 
interested in social-networking services with murky business models who 
want to 'help' me).   I'll not say more except here's a novice explanation:
https://snorre.io/gpg-web-of-trust-and-keybase-io/