Comment Aka "Pgp Key signing party" (Score 3, Interesting) 24
The problem is doing PGP signing the right way. I really suggest anyone attending one of these events take a look at web pages that describe "PGP Key Signing Parties" (just google, you'll find a bunch) to get the idea. In brief, to be absolutely sure that you trust a key belongs to someone, you need to verify the following:
- The key ID (2BCA871D for example)
- The key type (DSA, RSA, etc)
- The key bits (768, 1024, 2048)
- The key fingerprint (A028 82B4 14CC
Now, the hard part is how do you verify that this human who has brought these bits of data is the actual human associated with the key? You can check their driver's license and things like that. But of course this is where it's much better to only sign keys of people you know, rather than just total strangers.