Very nice. Both DNS and WKD are real-time, and modifiable by an attacker. There's no trail of trust/history. It may be good for discovery, but trusting the key

Very nice. Both DNS and WKD are real-time, and modifiable by an attacker. There's no trail of trust/history. It may be good for discovery, but trusting the key requires more. I guess that it's better to have multiple independent ways to validate ownership of a key after you discover it. Cross-check various methods that require different levels of access, to see if something is fishy. Anyway, I'm off to implement wkd. :)