If you provide the key information electronically, there is a chance someone altered the information. The reason I ask for a paper copy of this information is to ensure the key I eventually sign is actually the key you want me to sign. It's easiest to use the OpenPGP key paper slip generator and bring the slip with you. That last requirement is a fuzzy requirement. When someone asks me to verify his or her key, I ask that person to provide me a written or printed copy of the key's fingerprint, ID, size, type and UID(s) they want me to sign. If I'm signing the key in the context of a keysigning party or other organized signing event, my strategy or procedure is slightly different than if I'm signing a person's key individually. There is also a slight difference depending on signing context. The first is the key itself, to ensure that it is the key the person wants me to sign and the second is the person's identity, to ensure that that person is identified by the UID(s) on the key. VerificationĪs far as verifying a person's key I have two different pieces of information I need to verify.

What follows is my process for verifying keys and how I go about signing after I've verified. I had planned to write this post anyway, but now seems like as good a time as any.

At the php keysigning and PGP open space the question of how to actually sign keys came up.

Generate pgp key windows 10