Difference between revisions of "Trust Graph"

Revision as of 18:56, 24 February 2026

Definition

Context

Web of Trust

Phil Zimmermann, the creator of Pretty Good Privacy (PGP). spoke and wrote explicitly and repeatedly about the Web of Trust as a deliberate alternative to centralized authority. Here is what he actually said, using direct statements and closely paraphrased explanations from his own writings and interviews.

Zimmermann’s core idea: trust without central authorities Zimmermann introduced the Web of Trust to solve what he saw as the fundamental problem of public‑key cryptography:

How do you know a key really belongs to the person it claims to belong to, without relying on a central authority?

He rejected certificate authorities as the default answer and instead designed a peer‑to‑peer trust model. In The Evolution of PGP’s Web of Trust, Zimmermann explained:

The Web of Trust describes the way the system operates about as accurately as any phrase. It is a solution to the problem of connecting people who have never met and therefore never had a chance to exchange secure keys. [philzimmermann.com]

What “trust” meant to Zimmermann (and what it did not) Zimmermann was careful to define trust narrowly and mechanically — not socially or emotionally. He wrote:

Trust is the mechanism that is used to decide whether a key is valid. A key is valid if it is actually owned by the person who claims to own it. You tell PGP whom you trust to introduce keys; in return, PGP tells you which keys are valid. [philzimmermann.com]

So in Zimmermann’s model:

Trust ≠ believing someone is “good”
Trust = believing someone is competent to vouch for key ownership

Why he opposed centralized PKI

Zimmermann explicitly designed the Web of Trust as an alternative to hierarchical certificate authorities (CAs).
In explanations of PGP’s design, he emphasized that:

There is no central controlling authority

Each user issues and manages their own certificates
Trust emerges from overlapping personal attestations

This reflected his political and civil‑liberties concerns. As summarized in a technical history of PGP based on his writings:

Zimmermann’s approach to digital certificate administration, with its “web of trust,” mirrors his concern that people should have the power to control their own privacy. PGP empowers people to take their privacy into their own hands. [hxmel.com]

“Web of Trust” as an early peer‑to‑peer network Zimmermann later pointed out that the Web of Trust was historically significant beyond cryptography. In Beautiful Security, he and Jon Callas wrote:

The Web of Trust was an early peer‑to‑peer design, and arguably one of the first social networks. [philzimmermann.com]

This was not metaphorical — the trust graph literally consisted of:

People signing other people’s keys
Chains of introductions
Local decisions about whom to trust and how far that trust extends

Why he believed it mattered politically Zimmermann consistently linked the Web of Trust to resistance against surveillance and control. In Why I Wrote PGP, he warned:

The government has a track record that does not inspire confidence that they will never abuse our civil liberties.
To make cryptography harder to criminalize, use it as much as possible while it is legal. [hxmel.com]

The Web of Trust was part of that strategy:

No central authority to pressure
No single point of failure
No institution that could be coerced into mass surveillance

One‑paragraph summary (faithful to Zimmermann)

Phil Zimmermann described the Web of Trust as a decentralized, peer‑to‑peer system for establishing the validity of cryptographic keys without relying on central authorities. Trust, in his view, was a local, user‑defined mechanism for deciding who is competent to vouch for key ownership. He saw the Web of Trust not only as a technical solution, but as a civil‑liberties design choice that put control of privacy directly in the hands of individuals. [philzimmermann.com].

References