A self-signed key is not trusted because anyone and any computer can create one. A trusted key is one that is signed by a trusted certificate authority; a certificate authority is supposed to have some positive means of identifying the person or business who created the key, so that (for example) if the key is used to sign malware, the authorities know who dunnit.

It's not always as reliable as it should be. On several occasions, Comodo, a well-known CA trusted by nearly every browser and computer, has been tricked into creating keys for Russian organized crime which have been used to sign malware. (I once saw a copy of the W32/Zlob malware signed by a key issued to "Mistland Ltd," which is the name of a legitimate real estate agency in London. It seems that Russian organized crime somehow tricked Comodo into believing that they were representitaves of Mistland Ltd. and needed a code-signing key.)


Photo gallery, all about me, and more: www.xeromag.com/franklin.html