GPG has no central CAs, but relies on a &quot;web of trust&quot; situation. In reality, there&#x27;s no one central that everyone trusts, so unless the keys are signed by some individual you personally trust, you&#x27;re down to being reliant on getting valid keys.