Koch: A New Future for GnuPG

It's easy to build your own centralized PKI on top of a decentralized system like OpenPGP. For example, designate one key as the CA-equivalent, tell everyone to mark that key as fully trusted (or more likely, have IT do it for them), and then use that key to sign all the other keys.

OTOH, building a decentralized system on top of a centralized system is substantially harder.