Hacker News Reader

Well, that's one of the most powerful arguments in favor of CAs I've ever heard.

That's precisely why you only use subkeys in daily life and only use the root key for keysigning (and ideally store it safely and offline).

Good point, but will it be less than all the effort and money about to be expended in the coming months? Who knows. For the record I did say that PGP may not be the solution.

The other great thing is that PGP is not just for sites but for people, so even if all the private keys handled by nginx/apache/whatever were compromised Heartbleed-style, the core person-to-person trust relationships would be unaffected; the core of the web of trust would be intact, only the endpoints would need re-verified.

That's a great point worth repeating. Your personal trust relationships probably don't also change when your bank gets hacked and needs to replace their keys, and a network of a certain size will restore access to your bank relatively quickly due to friend of a friend connections.

It also reduces the burden on your bank for maintaining the security of their keys (to some extent). It's still very important, but the consequences are no longer quite so catastrophic.