Keys can be signed like every other file to guarantee their authenticity and integrity. If you are absolutely sure an imported key belongs to the individual specified as the owner, express your trust in the authenticity of the key with your signature.

	Establishing a Web of Trust
Encrypted communication is only secure to the extent that you can positively associate public keys in circulation with the specified user. By cross-checking and signing these keys, you contribute to the establishment of a Web of Trust. For these reasons, make really sure you only sign keys you personally checked.

Select the key to sign in the key list. Select Keys+Sign Keys. In the following dialog, designate the private key to use for the signature. An alert reminds you to check the authenticity of this key before signing it. If you have performed this check, click Continue and enter the password for the selected private key in the next step. Other users can now check the signature by means of your public key.

Normally, you are asked by the corresponding program whether you trust the key, or rather, whether you assume it is really used by its authorized owner. This happens each time a message needs to be decrypted or a signature must be checked. To avoid this, edit the trust level of the newly imported key. By default, the newly imported key is listed with a white box, meaning that no concrete value has been assigned for the trust level. To trust a key, do the following:

The lower the trust level is, the less you trust the signer of the key to have checked the true identity of the keys signed. You may be entirely sure about the signer's identity, but he may not check other people's identities properly before signing their keys. Therefore, you could still trust him and his own key, but assign lower trust levels to the keys signed by him. Notice that the trust level does not trigger any automatic actions by KGpg.

By means of the Import tab in the key server dialog, import public keys from one of the Internet-based key servers. Select one of the preconfigured key servers and enter a search string (e-mail address of the communication partner) or the ID of the key to find. When you click Search, your system connects to the Internet and searches the specified key server for a key that matches your specifications. Refer to Figure 10.3, “Search Screen for Importing a Key”.

Figure 10.3. Search Screen for Importing a Key¶

If your search on the key server is successful, a list of all retrieved server entries is displayed in a new window. Select the key to include in your key ring and click Import. See Figure 10.4, “Hits and Import”. Confirm the following message with OK then exit the key server dialog with Close. The imported key then appears in the main overview of the key manager and is ready for use.

Figure 10.4. Hits and Import¶

To export your key to one of the freely accessible key servers on the Internet, select the Export tab in the key server dialog. Designate the target server and the key to export by means of two drop-down menus. Then start the export with Export.

Figure 10.5. Exporting a Key to a Key Server¶

Files copied to the clipboard can easily be encrypted with a few clicks. Open the function overview by right-clicking the KGpg padlock icon. Select Encrypt Clipboard and designate the key to use. A status message about the encryption procedure is displayed on the desktop. The encrypted contents can now be processed from the clipboard as needed. The decryption of clipboard contents is just as easy. Simply open the menu on the panel, select Decrypt Clipboard, and enter the password associated with your private key. The decrypted version is now available for processing in the clipboard and in the KGpg editor.

To encrypt or decrypt files, click the icons on the desktop or in the file manager, drag them to the padlock in the panel, and drop them there. If the file is not encrypted, KGpg asks for the key to use. As soon as you select a key, the file is encrypted without any further messages. In the file manager, encrypted files are designated with the suffix .asc and the padlock icon. These files can be decrypted by clicking the file icon, dragging it to the KGpg symbol in the panel, and dropping it there. If the original filename already exists, a dialog opens that asks how to name the file or if it should be overwritten.

Instead of creating contents for encryption in an external editor then encrypting the file with one of the methods described above, you can use the integrated editor of KGpg to create the file. Open the editor (Open Editor from the context menu), enter the desired text, and click Encrypt. Then select the key to use and complete the encryption procedure. To decrypt files, use Decrypt and enter the password associated with the key.

Generating and checking signatures on documents is just as easy as encrypting directly from the editor. Select a file in the file manager and copy it to the clipboard. Right-click the padlock icon in the panel and select Sign/Verify Clipboard. Then choose the private key to use and enter the associated password. KGpg informs about the successful generation of the signature. Files can also be signed from the editor by simply clicking Sign/Verify. To check a signed file, go to File+Open Editor, load the file to check in the editor, and click Sign/Verify.