How PGP Calculates Trust

When you add a new public key to your public-key ring, trust processing proceeds as follows:

1. If you own the key, a value of ultimate trust is automatically assigned to
   the trust field. Otherwise, PGP asks that you assign a trust assessment to
   the key's owner. You can specify that this owner is unknown, untrusted,
   marginally trusted, or completely trusted.

2. When the new public key is added to the ring, one or more signatures
   can be attached to it. (More signatures can be added later.) When a
   signature is inserted into the entry, PGP searches the public-key ring
   to see if the author of this signature is among the known public-k
ey
   owners. If so, the owner trust value for this owner is assigned to the
   signature trust field for this signature. If not, an unknown-user
   value is assigned.

3. The value of the key-legitimacy field is calculated on the basis of the
   signature trust fields present in this entry. If at least one signature
   has a value of ultimate trust, then the key legitimacy value is set
   to complete. Otherwise, PGP computes a weighted sum of the trust values.
   A weight of 1/X is given to signatures that are always trusted, and
   a weight of 1/Y is given to signatures that are usually trusted, where
   X and Y are user-configurable parameters. When the total weights of
   those introducing a key/UserID combination reaches 1, the binding
   is considered to be trustworthy, and the key legitimacy value is set
   to complete. Thus, in the absence of ultimate trust, at least X
   signatures that are always trusted or Y signatures that are usually
   trusted (or some combination thereof) is nee
ded.