One interesting thing I've learned about most rubygems keys is they don't have chains back to CAs - they tend to be self-signed, and the docs encourage this. In fact, AFAICT there aren't any default trusted CAs for rubygems (unlike, say, the list your browser or OS has) - every signer has to be trusted manually with `gem cert --add`. So you end up with a PGP-like trust model on top of X.509 certs.

I don't know exactly what this rationale was behind this model - I plan to explore this further in subsequent posts. I'm a relative neophyte to code signing - part of the reason I'm writing these posts is to teach myself how things work.