Where is Web of Trust being used? I've been trying to find specific examples of where Web of Trust is being used today, but there seems to be little information about this. Are there any businesses using Web of Trust today? What do they use it for?
I have encountered PGP quite often in the business world, but never any use of the "Web of Trust". People just send each other their public keys over email and then check fingerprints over a phone call, or merely hope for the best. (I really encountered a customer who insisted on checking the fingerprint over a phone call, but that happened only once over the last 15 years.)

The "Web of Trust" mechanism does not map well to the business world. Arguably, it does not map well to the world in general. The main problem with the Web of Trust is that it conflates two concepts into one property: the identity, and the ability to authenticate.

For instance, suppose that Alice sign's Bob's key, then Bob sign's Charlie's key. The "Web of Trust" posits that if I already know Alice's public key, then I can gain some confidence in Bob's and Charlie's public keys. However, this is not really true. I know Alice and I know that she would not sign Bob's key unless she has thoroughly verified that she was talking to the real Bob, and signing a public key that is really under the control of Bob. However, I do not know Bob. For all I know, Bob could be very gullible, or prone to sign keys late at night after too many whiskies. Thus, I cannot really trust that the apparent Charlie's key really belongs to Charlie. In other words, Alice asserts that a given key belongs to Bob, but not that Bob is a reliable person who will apply all proper identity checks before signing other keys.

In the PKI world (X.509 certificates), things are hierarchical, and when a CA signs a key (i.e. issues a certificate), it can make an assertion on the reliability of the target entity: a CA may issue a CA certificate to a sub-CA (the Basic Constraints extension in that certificate will contain the cA flag set to TRUE), or an end-entity certificate (the cA flag is FALSE). In the former case, the CA delegates its power, while in the latter it does not. This is the main difference between X.509 PKI and the PGP Web of Trust. PGP lacks the distinction that is expressed by the cA flag in X.509 certificates. A consequence is that the PGP Web of Trust is rather useless, and this may go a long way towards explaining why nobody uses it.