Can you point me to a site that discusses the best practices for generating and securing my keypair? I don't have enough faith in an Instructable to get all the details right. How would I go about becoming part of this "web of trust" that I keep hearing about in relation to PGP.
The biggest thing to worry about is that you only want the private key on systems you trust. If you put your private key on a USB stick, and use the local library or computer lab, you've already lost the battle. If you're running a totally infected Win95 machine, you've already lost the battle.
Second biggest thing is to make sure you properly generate a revocation certificate, and a backup, and store them in a location you consider secure. (And maybe that secure location is just a shoebox in your bedroom closet unless you're worried about the NSA or something.) Then if you realize you've done something stupid, you can just revoke the key and create a new one.
Other than that, there's not much to screw up if you follow the default settings when creating a key with gpg.
For email, I would also highly recommend using a local MUA that connects to gmail. Most people use Thunderbird + Enigmail, but there are other options. Enigmail also has a pretty good manual that covers both the how and why.
The various gpg-related mailing lists are also pretty friendly. They're low-traffic enough that people are always happy to answer basic questions; no RTFM replies.
While there are Internet services that purport to realize an actual "web of trust", the "web of trust" concept is really notional. It's more an idea than a thing. The idea is, instead of having a central authority that vouches for every key, you get your keys directly from your acquaintances, verify them directly with your acquaintances, and in turn vouch for those keys with your peers.
