A certification is a signature by one key over another key's user ID, made after checking identity (traditionally at key-signing parties). GnuPG computes validity from these certifications and the owner trust a user assigns to certifiers; it also offers TOFU (trust on first use) models and treats keys a user signed locally as valid.
In practice the web of trust works within communities such as Debian developers and the Linux kernel, but it scales poorly and exposes social graphs; the public SKS keyserver network, which distributed certifications, was crippled in 2019 by certificate-flooding attacks that attached tens of thousands of bogus signatures to keys, and has since shut down. keys.openpgp.org publishes identities only after e-mail verification and drops third-party certifications by default. Many projects now combine OpenPGP keys with fingerprint pinning, WKD or transparency logs instead.