42 handwritten signatures, and clicking an “OK box.” These have, of course, different levels of security and are appropriate for different circumstances. 6.3.6 Digital signatures that are created and verified by public key cryptography usually use algorithmic functions to generate two different, but mathematically related, “keys”. One key is used for creating the signature and the other for verifying the signature. The key used by the signatory to create the digital signature is known as the “private key,” while the more widely known key used to verify the signature is the “public key,” It is important that the signatory keep the private key secret since that is the basis for authenticity, although the user does not need to know the key but can use a smart card or other device to “sign,” The public key cannot be used to re-create the private key so it is possible for many people, including public institutions, to have a copy of the public key.36 6.3.7 Certification is an important element of digital signatures using public key cryptography. It is necessary that the relationship between the holder of the private key and its associated public key be capable of authentication or verification in order to prevent impersonation or fraud in an electronic environment. In order for key systems to work, the public key must accessible. If the parties know each other, this can be accomplished through prior arrangement or contract. Full use of ecommerce and the electronic environment, however, requires that trust be established when parties are strangers and, indeed, may not even know each other’s full identities. 6.3.8 The solution to this problem is the development of “certificate authorities” or “certificate services” that certify the identity of the parties exchanging cryptographic information over the Internet. Certificate authorities can also perform other functions, such as notary and timestamping services. 6.3.9 Certificate authorities can operate in either the public or the private sector. In examining the appropriate policy approach to public key infrastructures (PKIs) in Botswana, it will be necessary to determine the form and number of levels of authority that should be comprised in a PKI; whether the certifying authorities should be public authorities or licensed by public authorities; whether non-licensed certifying authorities should be permitted (presumably with a lower degree of 36 There are other techniques, including cryptosystems based on elliptical curves and “hash functions,” that may be used.