PKI uses a pair of keys: a public key and a private key. The public key is distributed widely and is used to encrypt the message. The private key is kept secret and is used to decrypt the message. When sending an email, a digital certificate containing the public key is attached. The recipient uses the public key to verify the sender's identity and to decrypt the email if necessary.