> So how do we know someone claiming my email address is me? We don't; except possibly by deficiencies of wry geek humor and lack of references to obscure arcana. I think PGP/GPG are for "signing" messages.