The advantage of PGP's model is that it doesn't require hours and hours
of legal fees to set up all of the contracts for the various PCA and
CA's, with all of the indemnifications and disclaimers of liabilities.
It's a great way to keep lots of lawyers gainfully employed, but I have
to wonder if business people have ever wondered whether they have spent
more money on lawyers than the value that they actually gained.
After all, just today I received over a thousand dollar's worth of
merchandise on the strength of nothing more than a fax'ed purchase order
--- and we didn't have to sign any complicated legal paperwork when we
purchased our fax machines!
If this is OK for you and your business partner you neither need PEM
nor PGP, but I think you describe a situation which many people would like
to see improved from a security standpoint. I agree with your description
of the advantages of the PGP model over the PEM (1422) model, but the
disadvantage is IMHO that it is only a comparatively slight improvement
over fax. I'm not saying that PGP isn't a great thing to have which offers
reasonable security at low cost for many applications, but I fail to
see how it can provide authenticity in large open communities.
Wolfgang Schneider
GMD