I find it amusingly ironic, that the primary framework for authenticating keys is inherently untrustworthy. As TFA mentions about 'poisoned keys' are only part

I find it amusingly ironic, that the primary framework for authenticating keys is inherently untrustworthy. As TFA mentions about 'poisoned keys' are only part of the problem. I have a key I created in the mid-to-late 90's using a super-secret-strong-password, and yupp; can't remember it. But it doesn't matter, because nothing I created or signed back then is worth looking at again. BUT that 'fear of re-loss' limits my current usage of PGP/GPG too. I have my accountant trained to decrypt my attachments and email, and I have my staff trained to use it too, but it's still a real pain in the ass. I would have much better faith in a system that I could remotely manage the keyserver for when I fuck up. Being able to 'reset the password' (maybe use a 2FA style system) would be nice, but would also make it meaningless. GPG-As-A-Service ? If I ever forget my SSH passphrase, I can always generate a new key because I also have access to the server to accept the new key. It's turtles all the way down.