Web of Trust

• How do you get the public key of a person?
• You can get it directly from them
• You can get it from someone you trust
• A public key can be signed by any number of people
• If you completely trust the person who signed it, then you can accept the key
• If you partially trust two or more people who have signed it, then you can accept the key
• Otherwise, you have no confidence in the key
• AUUG will sign keys of people by getting it directly from them
• Because I trust both AUUG people and the method they are using for authenticating keys, I will trust AUUG-signed keys