The difference between PEM and PGP, and why I think that PGP is doing
so well, is that PEM imposes this structure, and doesn't work without
it, which PGP *allows* this structure, but doesn't require it, and
works just as well with it as without it!
The only structure that PEM imposes is one of strict trust rather than
partial trust which is summed up if many people sign a key, etc. It
is possible to not join the Internet certification hierarchy and have
multiple trees.
Why? If I've never spoken to someone, why would I *want* to send them
e-mail? Because someone gave me their name? Well, then, I ask them
for the e-mail address as well, at the same time.
Suppose someone says "Person X at company Y is responsible for this -- you
may want to contact her."
-Ray