If you mean "federated" like DNS there is one interesting trick: if you specify the signing key in gpg using email (e.g. gpg -u example@domain.com --sign) GnuPG

If you mean "federated" like DNS there is one interesting trick: if you specify the signing key in gpg using email (e.g. gpg -u example@domain.com --sign) GnuPG will insert the email as Signer's UID packet [0]. You can inspect the signature using gpg --list-packets. Then when you verify the file the key is downloaded using Web Key Directory, so basically over HTTPS from the email's domain (in my example domain.com). I'm thinking of using this to verify git signatures. [0]: https://tools.ietf.org/html/rfc4880#section-5.2.3.22 https://tools.ietf.org/html/rfc4880#section-5.2.3.22