The first time I encountered the concept of a web of trust I was perusing the “Gnu Privacy Handbook[1]” as any good privacy advocate would do. At the time that document was written in the late 1990s, PGP in email[2] was a niche topic shared among security experts and enthusiasts, and while it is still widely used today, we normally expect end-to-end encryption to be taken care of for us. PGP, like Bitcoin, is made possible by public key cryptography. Initially, I assumed basic cryptography was enough to authenticate and prevent tampering of communications, so I was a bit taken aback to discover that a web of trust was integral to the process of sharing keys. Why would this be?
Consider this concrete example. You download a piece of software. You’re encouraged to also obtain a cryptographically signed file corresponding to the software release. You can verify the download is authentic by confirming the signature was produced by the developer’s public key. However, this still leaves one very important question: How do we know we have the correct developer’s public key and not an imposter key? In theory, an attacker could insert a malicious download and still produce a valid signature made with the imposter public key. So we need a way of trusting that the public key we obtain is authentic. In practice, we accomplish this either by contacting the developer personally or designating a trusted web server that stores and disseminates public keys on behalf of their owners.
You can see we never really get around the issue of trust. The best we can do is find one trusted source and hope they can vouch for someone else and so on until we have built up a web of mutually
