some story first: Alice and Bob both have public/private key pairs. Now Bob wants Alice to sign his public key id. Alice agrees but only when Bob signs the public key id of her. Is this something ...
I noticed that PGP signatures have a "signed on" field. I was wondering if this is "trustworthy" information and if so how is it accomplished. For example, I can't see how it could be trusted ...