> Optional: verify public key on Keybase. For organizations publishing employee keys via Web Key Directory can also be an additional signal that the key is tru

> Optional: verify public key on Keybase. For organizations publishing employee keys via Web Key Directory can also be an additional signal that the key is trustworthy. It's also quite simple: for example exporting the key 5C090ED7318B6C1E (binary, not armored) and putting it on this exact URL: https://datadoghq.com/.well-known/openpgpkey/hu/964aj6q73iatngoya1q7qs4r6utpmb4g https://datadoghq.com/.well-known/openpgpkey/hu/964aj6q73iat... is enough to discover the key using e-mail address. This post goes into more detail: https://spacekookie.de/blog/usable-gpg-with-wkd/ https://spacekookie.de/blog/usable-gpg-with-wkd/ WKD is used by Linux distros (ArchLinux, Gentoo, Debian...) and kernel.org itself: https://www.kernel.org/category/signatures.html#using-the-web-key-directory https://www.kernel.org/category/signatures.html#using-the-we... as well as some OpenPGP sites (e.g. ProtonMail).