>>51040130To add to this, people will need to be able to verify that the public key they think belongs to you actually is yours. You can upload your public key to a keyserver (like
pgp.mit.edu, you upload it to one and it propagates to the others) where people can find it.
You verify people's identity by signing keys: you validate the ownership of the key (usually, someone shows you their public key fingerprint and some form of official ID), sign it with your private key, send the signed key back to the person, and they can upload it to the keyserver. The keyserver shows their public key, and the signatures of people who signed it. By signing keys, you build a web of trust: for example, my key is signed by my colleagues, some friends, my old college information security prof and some other people, and I've verified and signed their keys in return. When a message arrives signed with their key, I trust that message to actually come from that person. I also trust those people to be careful in verifying public keys, so I usually trust the identity of anyone who has their keys signed by one of my friends.
Encrypting and signing messages is cool, but you need to be sure you've got the correct public key of the person you're talking to, or else you might be subject to a man in the middle attack. Meeting in person and exchanging the public key fingerprints is the best way but sometimes impossible, having people you trust verifying the person you want to talk to is a good compromise.
