The implied missing steps are a)publish key to keyserver network, and b) get fingerprint from signature and look up key on keyserver network. Bundling public k

The implied missing steps are a)publish key to keyserver network, and b) get fingerprint from signature and look up key on keyserver network. Bundling public key with every mail "feels" a bit heavy handed - given the key server infrastructure that already exist. (and special-casing "mail to new receiver" seems cumbersome. At least considering you'd probably want to sign all outgoing mail anyway[1]). [1] Ok, maybe not your bomb threats if they're designed to be anonymous - but that's getting into one of the other issues with pgp - non-repudiation.