Wow, that is quite the KCF. This is the core problem: > The [SKS] software is unmaintained. Due to the above, there is literally no one in the keyserver commun

Wow, that is quite the KCF. This is the core problem: > The [SKS] software is unmaintained. Due to the above, there is literally no one in the keyserver community who feels qualified to do a serious overhaul on the [OCaml] codebase. The solution is simple: don't use the SKS keyserver network. > High-risk users should stop using the keyserver network immediately. I used to use it, but mainly I just send people signed messages, and ask them to send me their public keys. I point them to my Keybase page, in case they prefer to encrypted key. But that isn't generally practical. So about the mitigation. > Users who are confident editing their GnuPG configuration files should follow the following process: > Open gpg.conf in a text editor. Ensure there is no line starting with keyserver. If there is, remove it. This part makes sense. > Open dirmngr.conf in a text editor. Add the line keyserver hkps://keys.openpgp.org to the end of it. I'm not sure whether that's necessary. For Debian users, adding keyring.debian.org makes sense. But otherwise, isn't it best to get keys from first-party sources?