Managing PGP Keys PGP uses the concept of a keyring. Public keys are stored in a keyring. Public keys may be given to you by their owner or may be obtained from special key servers that are located around the world. When a public key is first created, PGP assigns a random and unique number to the key called a fingerprint. The fingerprint can be used to validate a public key to check to make sure that it wasn t forged.
CERT publicizes that a forged CERT key is making the rounds on the internet.
They advise users to check the hexadecimal fingerprint of CERT public keys with the fingerprint information published on their website. It s always wise to check the fingerprint of all public keys you use to verify they are not forged. PGP fingerprints also choose several of 255 biometrically different English words to represent byte patterns. If you wanted to call a person on the telephone to verify their public key, instead of reading off a list of hex numbers, they could just read off the list of words. This is much less prone to error than using only hex numbers.