On Thu, 29 Jan 2004, Ian Grigg wrote:
Some random comments.
One of the most perceptive decisions that the early PGP
designers made was to not define trust. This was a good
decision because trust defies definition. Trust is too
much wrapped up in context of the user and her companion
users, and the programmer can't really narrow that down
usefully ahead of time.
I wouldn't say that they didn't define trust. PGP has internal trust
calculation algorithms, which happen not to be documented within the IETF.
I have always thought this unfortunate. I agree that trust calculation
should be orthogonal to the OpenPGP message format specification, but I do
wish that it were documented.