I'm in the process of setting up and hardening a new server. I'm new to the concept of apt-secure, but am trying to get my footing here. Having just finished Ubuntu setup, I see that there appear to be four keys in my apt keyring:
prompt%:~/biz/myplan$ apt-key finger
/etc/apt/trusted.gpg
--------------------
pub 1024D/437D05B5 2004-09-12
Key fingerprint = 6302 39CC 130E 1A7F D81A 27B1 4097 6EAF 437D 05B5
uid Ubuntu Archive Automatic Signing Key <ftpmaster@ubuntu.com>
sub 2048g/79164387 2004-09-12
pub 1024D/FBB75451 2004-12-30
Key fingerprint = C598 6B4F 1257 FFA8 6632 CBA7 4618 1433 FBB7 5451
uid Ubuntu CD Image Automatic Signing Key <cdimage@ubuntu.com>
pub 1024D/3E5C1192 2010-09-20
Key fingerprint = C474 15DF F48C 0964 5B78 6094 1612 6D3A 3E5C 1192
uid Ubuntu Extras Archive Automatic Signing Key <ftpmaster@ubuntu.com>
Whose keys are these? How can I be sure that I can trust them?