Well, based on the above, I'd say it depends. Do you trust that this is the correct PAUSE key? If not, don't sign it. If so, sign it. What may help is to look at the key and see who else has signed it. Of course, that depends on you trusting that those others really did sign it, and it wasn't merely signed by some guy pretending to by merlyn or TimToady or whatever.

Personally, without finding a method to validate the fingerprint against a site that I do trust, I wouldn't sign it. And that's partly because, let's be honest here, you're no worse off than you were before this whole signing thing started. You trusted that CPAN authors weren't trying to hose your system by faking some code that looks like it's doing something useful, but actually is opening a hole in your security. And, with signing, all that does is prove that the person holding the private key (whoever that is) actually wrote that hole in your security. It has not increased your security significantly. But it does prevent tampering - if you get a patched module, the signature won't match anymore, and you'll know it, whether you trust the signature or not. Well, as long as you continue to read the warnings/run the tests. And I doubt that PAUSE is signing the modules (other than CPAN) anyway, so you'd actually still get the unknown warnings from new modules.

In reply to Re^3: cpan upgrade - "key is not certified with a trusted signature." Concern? by Tanktalus
in thread cpan upgrade - "key is not certified with a trusted signature." Concern? by locked_user sundialsvc4

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.