The advantage of PGP's model is that it doesn't require hours and hours
of legal fees to set up all of the contracts for the various PCA and
CA's, with all of the indemnifications and disclaimers of liabilities.
But about about those hours and hours lost trying to build a certification
path to a PGP public key? A simple finger or e-mail operation may give
the common user a certain degree of trust (and PGP allows, fortunately,
different
levels of trust), but is it really safe? Maybe it takes a great amount
of time to get things going, but it should compensate, in te long terms.
My point is: if you really want to do the things properly ( in
verifying other's public key), the use of CA and PCA should be of a
great advantage.
vitor