PKI vs Web of Trust vs TOFU: Trust Models Explained

With a public key, anyone can send you encrypted messages or check your signatures. But how do you know a key really belongs to you and not to an attacker pretending to be you? There are three fundamentally different answers: the hierarchical PKI with certificate authorities, OpenPGP’s web of trust, where users vouch for each other, and TOFU, trust on first use, as used by SSH and messaging apps. This guide explains all three trust models, their strengths and weaknesses, and the hybrids that are emerging.

The basic problem: whose key is this?

Public-key cryptography solves the problem of exchanging a secret key; see RSA vs AES. But it creates a new one: a public key is just a long number. If an attacker slips you their own key, you encrypt for them, and they can read the message, re-encrypt it and pass it on without anyone noticing. This man-in-the-middle attack can only be prevented if the link between key and identity is secure, and that is exactly what trust models provide.

Hierarchical PKI: trust through certificate authorities

For websites, S/MIME and code signing, a certificate authority (CA) vouches with its signature that a key belongs to a name. The CAs themselves are trusted because their root certificates are in your device’s root store; the path from certificate to root is described in how the certificate chain of trust works.

Strengths: it works without any effort from users, scales to billions of devices, and rules, audits and Certificate Transparency keep CAs in check.
Weaknesses: trust is centralised. Each of the many CAs can issue for any domain, and one CA’s mistakes affect everyone; see what is a root store.

Tree diagram: a root CA signs two intermediates, which sign the certificates of three websites. — Trust in a hierarchical PKI (example names).

Web of trust: users vouch for each other

In 1991 Phil Zimmermann released the encryption program PGP and with it a model with no central authority. Today the standard is called OpenPGP (currently RFC 9580 from 2024), and the best-known program is GnuPG. Everyone creates their own key, and users sign each other’s keys after checking each other’s identity, for example in person with an ID card. Conferences used to hold key-signing parties for this.

Each user decides how much weight a stranger’s signature carries. With GnuPG’s default settings, a key counts as valid if it has been signed by one fully trusted or three marginally trusted contacts. The result is a web in which trust is passed along over a few steps.

Strengths: no central body that can fail or be put under pressure; everyone decides for themselves.
Weaknesses: it is complicated, too much effort for most people, and the web reveals who knows whom. In 2019 the keys of well-known developers on the public key servers were also flooded with tens of thousands of junk signatures, until GnuPG could barely process them. Newer key servers such as keys.openpgp.org therefore no longer store third-party signatures.

Network diagram: you trust Anna fully and Ben, Cara and Dev marginally; all four have signed Eva’s key, so it counts as valid under GnuPG’s default rule. — The web of trust with GnuPG’s default rule (example names).

TOFU: trust on first use

TOFU stands for “trust on first use”: on first contact, the other side’s key is stored without being checked, and on every later contact it is compared. If it changes, the program raises the alarm. The best-known example is SSH:

The authenticity of host 'server.example.co.uk (203.0.113.10)' can't be established.
ED25519 key fingerprint is SHA256:Rj4f6...
Are you sure you want to continue connecting (yes/no/[fingerprint])?

Typing “yes” stores the key in the known_hosts file. If the server key changes later, SSH gives a loud warning: “REMOTE HOST IDENTIFICATION HAS CHANGED”. More in how to generate and use SSH keys. Messaging apps such as Signal and WhatsApp work in a similar way: they store a contact’s key and tell you when the safety number or security code changes. To be sure, compare the number once in person, for example by scanning a QR code.

Strengths: no effort and no third party; very good protection against attacks after the first contact.
Weaknesses: if the attacker is already in the middle at the first contact, their key gets stored. And warnings tend to be clicked away when servers are rebuilt.

Three steps: on first contact SSH stores the fingerprint, later it compares the key, and on a mismatch it gives a loud warning. — Trust on first use in SSH.

The three models compared

Who vouches? In a PKI the CA, in a web of trust other users, with TOFU nobody, only the memory of the first contact.
Effort for users: none with a PKI, high with a web of trust, low with TOFU as long as no warning appears.
Weak spot: for a PKI every single CA, for a web of trust usability and the social graph, for TOFU the first contact.
Typical use: PKI for websites, S/MIME and software; web of trust for OpenPGP email and software packages; TOFU for SSH and messaging apps.

Hybrids and new approaches

In practice the boundaries are blurring:

SSH certificates: since 2010, OpenSSH has been able to have server and user keys signed by your own SSH CA. The TOFU question disappears, because the client trusts the CA.
Keys in DNS: SSHFP records and DANE publish fingerprints in DNS, protected by DNSSEC; see what are CAA records, DNSSEC and DANE.
OpenPGP via your own domain: with the Web Key Directory, the mail program fetches the key over HTTPS from the domain of the email address, so trust comes from the web PKI.
Key transparency: since 2023, WhatsApp and Apple have published directories of their users’ keys in verifiable, append-only logs modelled on Certificate Transparency. That reveals it if the provider ever slips someone a false key.

Frequently asked questions

Which model is the most secure?

None is best in every situation. For the general public a PKI is the most practical, while keys checked in person are the strongest for individual contacts.

Should I always type “yes” in SSH?

On first contact with your own server, compare the fingerprint with the one the server itself shows (ssh-keygen -lf on the server’s key file). If a warning appears later, never just accept it; find the cause.

Is the web of trust still used?

Yes, mainly for signing software and in developer communities such as Linux distributions. It never caught on for everyday email.

Is a Signal safety number a certificate?

No. It is a fingerprint of both people’s keys. Nobody vouches for it except you, when you compare the numbers.

Conclusion

Trust models answer the question of whom a public key belongs to. The hierarchical PKI relies on vetted certificate authorities, the web of trust on mutual vouching, and TOFU on the first contact. Newer approaches such as SSH certificates and key transparency combine the advantages.