When I found these comments by Carl Ellison I threw out much of what I had said on the subject because he had said it much more clearly and with less jargon.

My favorite example is that a soft drink dispensing machine can have an adequately secure transaction with me without knowing who I am. The Digital Silk Road is predicated on iterated small transactions for building appropriate trust relationships with others known only by routing information.

The notion of identity arises when one receives stimuli from several sources and there is reason to believe that they were due to the same thing, whose “identity” then begins to be a useful concept.

In a network environment (of machines or people!) you get reports or recommendations about some entity. If the recommendations are good and from those that you have previously learned to trust then you may begin to trust the new entity.

If such reports each carry a public key to the recommended object then these keys can be compared and thus can one be sure that the recommended objects are one in the same. The recommendations may accumulate. We have evolved to do such processing intuitively. PGP tries to automate some of this. Trusting my intuition, as I do tautologically, and having no evidence that the algorithms in PGP are equivalent, I am skeptical of the trust management algorithms of PGP. Further I may trust some acquaintances in some matters, but other acquaintances in other matters. The software I use should use ordinary names in order to adapt to my intuition. It must also understand that that name space is neither entirely private nor entirely public. This might involve constructs such as “the person known to joe as ‘Ann’”.

The issue is which keys I trust for which matters. PGP focuses instead on how certain it is that a key corresponds to some “person − name”.