Quote from: o_e_l_e_o on August 29, 2021, 05:43:30 PM

Quote from: PrimeNumber7 on August 29, 2021, 01:10:07 PM

-snip-

Sure, but reading OP's posts, he is brand new to using GPG and is importing a single key belonging to ThomasV to verify a single piece of software. He is highly unlikely to be importing other keys at this stage, and even less likely to be using them to build a web of trust since he doesn't know whose keys to trust or even how to sign that he trusts them. Yes, it is a good idea to sign keys once you understand why you should do so (which is explained in the link I gave), but I think forcing him to sign a key when he doesn't understand why is counterproductive to assisting him to safely install Electrum, which is what his ultimate goal here is.

Even if someone is new to using GPG, I would recommend relying on a Web of Trust and/or signed keys. I might compare relying on an unsigned key to be similar to relying on a generic signed bitcoin message that could potentially involve you not being the intended audience of the signor (the signed message is being reused).