Web of Trust (WoT)

A Web of Trust (WoT) is a decentralized model for establishing the authenticity of cryptographic keys and, by extension, the identity of participants in a network. Unlike centralized Public Key Infrastructure (PKI), which relies on a single Certificate Authority (CA), a WoT allows any participant to vouch for, or sign, the public keys of others they personally trust. This creates a distributed, peer-to-peer network of trust relationships where credibility is derived from the aggregate of these attestations. The model was popularized by Phil Zimmermann's Pretty Good Privacy (PGP) encryption software for email.

The core mechanism involves key signing parties and trust signatures. When Alice signs Bob's public key, she is cryptographically asserting that she believes the key genuinely belongs to Bob. This signature becomes a trust path that others can follow. If Charlie trusts Alice, and Alice trusts Bob, Charlie can extend a degree of trust to Bob through this transitive chain. The strength of a participant's verified identity depends on the number and quality of signatures from other trusted parties within the graph, forming a reputation system.

In blockchain and decentralized systems, WoT principles are applied to solve identity and oracle problems. For instance, they can validate the real-world identity behind a decentralized identifier (DID) or gauge the reliability of data providers in a decentralized oracle network. Projects like Keybase have implemented social WoTs to link online identities to cryptographic keys. The model's major strengths are its censorship resistance and lack of a single point of failure, but challenges include the bootstrapping problem—establishing initial trust—and the complexity of managing and navigating the trust graph at scale.

The term Web of Trust (WoT) originated in the early 1990s within the Pretty Good Privacy (PGP) encryption ecosystem, conceived by Phil Zimmermann as a decentralized alternative to hierarchical Public Key Infrastructure (PKI). Unlike a centralized Certificate Authority (CA), a WoT allows individuals to act as trust anchors by digitally signing each other's public keys, creating a decentralized network of verified identities. This model of peer-to-peer verification became a foundational concept for decentralized systems, predating blockchain by decades.

The core mechanism involves a user building a personal keyring of trusted public keys, where trust is not absolute but transitive across the network. If Alice trusts Bob, and Bob trusts Carol, Alice can choose to extend a degree of trust to Carol, forming a trust path. This model introduced critical concepts like trust levels (e.g., marginal, full, ultimate) and the distinction between verifying a key's authenticity and vouching for the owner's identity. These ideas directly influenced later decentralized identity and reputation systems.

In the blockchain era, the WoT concept was adapted to solve identity and consensus problems without relying on financial stake or computational power. Projects like The GNU Name System (GNS) and certain Decentralized Autonomous Organizations (DAOs) use WoT structures for governance and attestations. The evolution from PGP's email security to a broader architectural pattern demonstrates its utility for creating sybil-resistant networks and forms the basis for many Decentralized Identity (DID) and verifiable credential frameworks today.

A Web of Trust (WoT) is a decentralized trust model where participants, or entities, vouch for each other's identities by issuing cryptographic signatures. Instead of relying on a single central authority, trust is distributed across a network of peers. Each participant maintains a keyring—a collection of public keys—and assigns a trust level to the keys belonging to others. This creates a graph-like structure where trust is inferred through chains of signatures, known as trust paths. The model was popularized by Phil Zimmermann's Pretty Good Privacy (PGP) encryption software for email.

The core mechanism involves key signing. When User A signs User B's public key, they are making a statement that they have verified B's identity and that the key genuinely belongs to B. This signature is bundled with B's key into a data structure often called a certificate. Other users can then rely on A's signature to trust B's key, especially if they already trust A. The strength of this inferred trust depends on the signature's validity, the signer's own trustworthiness, and the length and quality of the trust path connecting the two parties.

Establishing trust levels is critical. Common designations include unknown, marginal, full, and ultimate trust. Ultimate trust is typically reserved for one's own keys. A system might require, for example, two marginally trusted signatures or one fully trusted signature to consider another key as valid. This flexible, user-centric policy allows individuals to decide whose endorsements they value, creating a personalized and resilient trust framework resistant to single points of failure.

In blockchain and decentralized systems, the WoT concept is applied to decentralized identity (DID) solutions and reputation systems. It enables peer-to-peer verification without intermediaries, allowing users to prove attributes or credentials through a verifiable chain of attestations. Unlike traditional Public Key Infrastructure (PKI), which depends on a hierarchy of centralized Certificate Authorities, a WoT is peer-to-peer and user-empowered, making it suitable for censorship-resistant networks and applications prioritizing user sovereignty over identity.