I am making my own gpg server (based on the MIT one). I noticed something weird in the GPG chain of trust.
- I create my
VeryTrustedKey. I push it to my gpg server. In my code, I force all users to havefulltrust for this key. It will be thetrusted introducerfor all users. - A user
User1upload his keykey1to my server. It is signed byVeryTrustedKeyon day 1 of the upload. - On day 2, a user
User2import thiskey1key. BecauseUser2has a trustfullonVeryTrustedKeyhe also has a trustfullonkey1. - On day 3,
User1loses his private key.VeryTrustedKeyrevoke the signature it has withkey1.
The issue is that on day 4, User2 still fully trust key1, even after refreshing from the server (A refresh by command line using gpg --recv-key KEYID then gpg --refresh-keys)
Is that normal ? How can I make it that trust will go away on a trust introducer revokation.