PoP & Signer's User ID subpacket?

[Trevor Perrin <trevp@xxxxxxxxx>]

I could be wrong, but it seems like PGP keysigning often happens without 
Proof-of-Possession of the corresponding private key.  For example, at PGP 
keysigning parties, I think it's common for people to attest that a 
fingerprint really belongs to them, but not have to produce signatures with 
the corresponding private key.

Is there a risk that Alice could trick someone into certifying that Bob's 
public key belongs to her?  Then someone receiving a signed message from 
Bob might incorrectly think it came from Alice.

Maybe, as a Security Consideration, the "Signer's User ID" subpacket should 
always be included in signatures.  If Bob always included this subpacket in 
his signatures, then no-one could be tricked into thinking Bob's signed 
messages really came from Alice.

Trevor