keysigning

Keysigning is a practice in public-key cryptography in which a person signs another individual's public key to attest that the key genuinely belongs to the stated identity. It is most commonly used in OpenPGP systems (such as GnuPG) and is a core component of the web of trust model.

The process typically involves identity verification, often in person or through trusted channels. The signer checks the claimant's identity against government-issued IDs or other trusted credentials, then uses their private key to create a digital signature on the claimant's public key, binding the identity to the key. The resulting certification proves that the signer has verified the association at the time of signing.

Signed keys are distributed by uploading them to public key servers or by exchanging key files. Other users can retrieve the key and see the signatures, which contribute to the key's credibility. Parties may hold key-signing events where participants verify identities and sign several keys in a single session.

Keysigning is rooted in the web of trust rather than a centralized certificate authority. Trust is a local, subjective decision; a key's trustworthiness increases as it gains signatures from people one already trusts. Some implementations support different trust levels that influence how signed keys affect acceptance decisions.

Caveats include varying identity verification standards, the risk of key compromise, and the need to revoke signatures if a signing party's key is compromised. Signatures can be revoked or expire, and routine key management practices are advised.