One perfectly valid way so solve the web of trust issue with PGP is to simply ignore the web of trust issue with PGP. Just stick your pubkey on your website and

One perfectly valid way so solve the web of trust issue with PGP is to simply ignore the web of trust issue with PGP. Just stick your pubkey on your website and you are done. You just understand that there is a very low chance that any encrypted email from an unknown entity is actually from a composite entity. If you think that you are of interest to entities that have the ability to MITM your pubkey, you might want to mention the problem to potential unknown email senders as a disclaimer on your web page. In practice an entity with the power to MITM pubkeys is not going to use the facility unless they are really really sure as they are eventually going to get caught at it. Things like Signal and Whatapp don't solve the web of trust issue either so you are not any worse off by using the head in the sand approach.