Things we should know about PGP

If this discussion can't be stopped, than perhaps we can make it a
useful thread, by not talking about how to behave or not to behave on a
mailing list, by not talking about if we won't signed emails or not.

If you really need security, than you need to take care about many
things using PGP. I only use openPGP from time to time, to ensure that
just a special person can read this mail, but not to be completely
secure. I don't need knowledge about how to handle PGP correct and I
don't have got this knowledge.

Seemingly some people have completely wrong perceptions about e.g.
signing a key.

Instead of having something similar to a flame-war, some useful
information belongs to this list.

Exactly. For instance, those who think that PGP signed messages will
improve security when reading/posting e-mails >;-)

I didn't check beyond the other person: if they have sigs on their key,
then it's feasible Mika is joined to a/the web of trust. Rather than
try to manually construct such a path, I fed Mikka's key into pathfinder
web sites, but his key is not widespread enough, and the ones I tried
didn't know about him. I did not rule him out of the web of trust, nor
prove him in.

When the subject was "gpg/pgp noise" Jon Dowland wrote: "I clearly
explained that his key was signed by another he owned, which in turn was
signed by *someone else entirely*."

A chain of unsigned keys for one and the same person, with one key at
the end of this chain, that is signed by one person only or even enough
persons signing it, is useless. This isn't the correct way to sign a
key, since it's not secure and not handy.

OTOH, when do you really need signing? More likely is that you will
encrypt mails, e.g. to ensure that if you write to a family with young
children, using the same computer, only the parents can read mails with
contents that aren't good for children. In such a case it's not needed
to ensure that the key is trusted. It's only important that the parents
know how to decrypt and the children don't know it. This anyway prevents
against manipulating the mails content, without signing.

I didn't check beyond the other person: if they have sigs on

then it's feasible Mika is joined to a/the web of trust.

try to manually construct such a path, I fed Mikka's key into

web sites, but his key is not widespread enough, and the ones

didn't know about him. I did not rule him out of the web of

prove him in.