the big problem that stuck out for me is that it is an unsigned pgp key hosted on another site. Which means someone could easily replace the key with something

the big problem that stuck out for me is that it is an unsigned pgp key hosted on another site. Which means someone could easily replace the key with something else and man in the middle the communication. At least have a couple trust worthy public sources sign your key if you going to asking people to communicate with you about very sensitive information