Keep web of trust - Allow endorsements

PGP was built on top of a "web of trust", expecting that users would sign the crap out of each other's keys to replace a centralized certification authority. It's why a service like Keybase hasn't existed before. The problem is that this isn't exactly user friendly. It's arcane and confusing.

Keybase should keep with that tradition, and make it easier, too.

You could call it sign key, but that might be a bit confusing. I'd call it 'endorsing' someone's key. You endorse a key if you know a person, and know that these are their accounts, and you further endorse it (remember the varied levels of trust in GPG?) if you've met them in person and have verified their fingerprint.

An endorsement would be the same as a key signing; Keybase (or the CLI application) handles the heavy lifting of signing the key and uploading the signature. It could stay compatible with people on the old 'web of trust' system by adding these signatures to their .asc file available on Keybase.

Added to the 'tracking' and 'tracked by' lists would be 'endorses' and 'endorsed by'. Under the proofs could be something similar to "This user's key is endorsed by 8 people, 2 of which you trust."

The documentation should make it very clear what an endorsement is and what it's not. It's not one confirming that one likes or is a fan of a person, it's one saying that they have personally talked to the individual, verified their identity (with varying strengths selective, from on the phone to inspected photo ID), and compared key fingerprints. Yes, you're still relying on people to be honest, but they should still be aware of what they're saying.

One should also be able to trust and not trust endorsements from a given user, based on how likely they believe that user to practice good judgement when endorsing other users keys.

Good idea?

No files, tests, or specific entry points are named. Start by reviewing the existing Keybase client, CLI, website, proof, and tracking flows, then clarify the product scope for signing and uploading compatible signatures, endorsement trust controls, and documentation. Done requires an agreed design covering these behaviors.

Written by the indexing model from the issue text.