[indeyets]

signature process is almost the same, but this thing uses different approach to "trust" to the signatures.

In case of S/MIME email client will tell you that signature is good if it the key, which was used for creating it was issued by a known CA (Certificate Authority).

In case of OpenPGP(GPG,GnuPG,…) you explicitly decide if signature is good either by verifying the key (once) directly with the sender or by using web-of-trust (you trust keys of your friends, who trust keys of their friends, who trusts your correspondent)

http://security.stackexchange.com/questions/7874/how-does-pg...