>Do you think that folk signing PGP keys are undertaking unlimited liability >should the certification turn out to be incorrect? The biggest difference between PGP and X.509, is that in PGP I can choose the level of trust. X.509 is based on doctorial model, where my browser is forced into trusting the certificate from a server.