This document represents the signing policy for my OpenPGP key:

pub   1024D/FCC5040F 2004-04-26
uid                  Stephan Beyer <s-beyer@gmx.net>
uid                  Stephan Beyer (Uni) <Stephan.Beyer@stud.tu-ilmenau.de>
uid                  [jpeg image of size 2193]
uid                  Stephan Beyer (university) <Stephan.Beyer@tu-ilmenau.de>
sub   4096R/595C92B1 2008-09-30 [expires: 2009-09-30]
sub   4096R/E704C985 2008-09-30 [expires: 2009-09-30]


See also
	http://pkqs.net/~sbeyer/openpgp/
for more information on the key.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

This policy applies to all OpenPGP keys 
	- which have been signed by me since July 01 2005, and
	- wherein my signatures have not been revoked.

This policy isn't valid for signatures which have been made before
July 01 2005, but most of those signatures underlie related rules.

This policy may change. See the ChangeLog data at the end of the document.

OpenPGP allows to set different trust levels on signatures, they're
abbreviated by sig0 ("I don't care"), sig1 ("Didn't check at all"),
sig2 ("Did casual verification") and sig3 ("Did extensive verification").

This document describes how I handle them:

sig3:
	I use trust level 3 to sign keys of persons which fulfil the
	following conditions:
		* I met them personally (in real).
		* I checked[1] the fingerprint.
		* I checked their identity card, passport or driver's 
		  license. Those must contain a photo of the owner and
		  must not be expired.
	
	I sign user IDs not having an e-mail address, if the first and last
	name is correct according to passport. Of course, I tolerate ASCII
	transcriptions of those names and real life, passport-like nicknames.
	
	I sign each user ID having an e-mail address, but, of course, only
	valid e-mail addresses will pass the "send check".
	
	The "send check" is simple:
		* For sign-only keys a mail is sent to the e-mail address
		  with a "checkword" in it. The key owner sends a signed
		  reply containing the checkword. If the sent and received
		  checkwords are equal and the signature is valid, the
		  check is passed and the user ID gets it signature via
		  e-mail or keyserver.
		* For other keys an encrypted mail is sent to the e-mail
		  address. This e-mail contains the user ID signature.
		  If the key owner is able to decrypt the mail / user ID,
		  the check is passed.
	
	I sign photo user attributes with trust level 3 if I know that
	the person I met looks like the person on the photo.

sig2:
	I do not use trust level 2 to sign user ids. (undefined)

	A photo user attribute gets trust level 2, if I'm not sure, if
	the person on the photo really looks like the person that I met.

sig1:
	I use trust level 1 to sign companies, organizations and CAs
	that I trust. sig1 signatures should be considered as
	`not checked' in passport, photo id, e-mail or anything.

sig0:
	Trust level 0 is left undefined and is hence not used.

Note: As a human being I could make mistakes. I try to avoid them.

I am open for suggestions and feedback on this policy.
Sorry for bad English.

Stephan Beyer

Footnotes
 1. The fingerprint they brought with them should equal the fingerprint of the
    key I want to sign.

ChangeLog:
 20050702 initial upload
 20060902 minor changes
 20070306 added sig3 nickname handling, 
          removed last sig2 sentence (too confusing)

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFF7LL4bt3SB/zFBA8RAozxAKDBUshWQl++RGnQmcg9j2N4cvlt4wCfcsGE
0Shb9IFSqw/YR5OwWjSsC5I=
=V6ej
-----END PGP SIGNATURE-----