The following is reproduced from the GPG Manual:
When you distribute your public key, you are distributing the public components of your master and subordinate
keys as well as the user IDs. Distributing this material alone, however, is a security risk since it is possible for an
attacker to tamper with the key. The public key can be modified by adding or substituting keys, or by adding or
changing user IDs. By tampering with a user ID, the attacker could change the user IDís email address to have
email redirected to himself. By changing one of the encryption keys, the attacker would also be able to decrypt
the messages redirected to him.
Using digital signatures is a solution to this problem. When data is signed by a private key, the correspond-
ing public key is bound to the signed data. In other words, only the corresponding public key can be used to
verify the signature and ensure that the data has not been modified. A public key can be protected from tamper-
ing by using its corresponding private master key to sign the public key components and user IDs, thus binding
the components to the public master key. Signing public key components with the corresponding private master
signing key is called self-signing ....
After generation of they key by - gpg --gen-key - how can one go about putting in a self-signature on the public key.
Thanks in advance.