diff --git a/.gnupg/gpg.conf b/.gnupg/gpg.conf
index dbbbd16..29575ba 100644
--- a/.gnupg/gpg.conf
+++ b/.gnupg/gpg.conf
@@ -1,10 +1,12 @@
-# in case --fetch-keys is used for WoT
+# block webbug + in case --fetch-keys is used for WoT
 keyserver-options no-honor-keyserver-url,no-self-sigs-only
 
 # ease key verification with all information
 keyid-format 0xLONG
 with-fingerprint
 
-# (marginal) trust on first use to have statistics on how often the key has
-# been seen, but still also pgp in case of trusted key(s)
+# trust on first use to have statistics on how often the key has been seen
 trust-model tofu+pgp
+# don't assign positive trust value first time keys are seen, in case there
+# is a trusted key as root for Web of Trust
+tofu-default-policy unknown