UCTrust PGP Key Signing Parties

The UCTrust participants rely on PGP cryptographic signatures to verify the authenticity of electronic mail communications and federation metadata that are critical to the operation of UCTrust.  In order to create the web of trust needed for this verification, key signing "parties" are conducted during UCTrust meetings.  This document describes this key signing process.

1. Prior to the meeting, people who are not yet part of the web of trust should install PGP software, generate a public / private key pair, and upload the public key to one of the global PGP key servers, such as subkeys.pgp.net.
2. Also prior to the meeting, everyone should bring cards or slips of paper showing their public key IDs and fingerprints, for example:

was generated with the " gpg --fingerprint david walker