3 ms·

keys.openpgp.org seems to claim that keys aren't searchable by email until the email is verified. Did you ever verify the email with them? If not something is g

keys.openpgp.org seems to claim that keys aren't searchable by email until the email is verified. Did you ever verify the email with them? If not something is going wrong. Maybe there is a problem in the service or maybe Proton Mail is working off of a dump and ignoring the "is verified" bit. https://keys.openpgp.org/about/usage#gnupg-upload https://keys.openpgp.org/about/usage#gnupg-upload

lxgr 3y ago
Even publishing a key as “searchable by email” should absolutely not be taken as an invitation by any client to encrypt by default, given the somewhat lacking ergonomics of GnuPG. I have a key published, but if somebody emails me encrypting to it, it would take me days to figure out where my smart card storing the private key is, how to use it on my current OS etc.
- brewdad 3y ago
  I'd probably be more sunk. When I was first learning and playing around with PGP, I published a key. Later, I changed the key for some reason or other but no longer had a way to revoke the old one. I'm pretty any of them out there are expired by now but for a few years it absolutely was possible to send me unreadable mail.
  - lxgr 3y ago
    I think they are only using the “email address verified keys” that these “new-style key servers” use, so you’d be able to at least revoke that binding as long as you can receive unencrypted emails to that address.
Valodim 3y ago
keys.openpgp.org operator here. It's definitely not a bug, we do not publish email addresses without verification. From our perspective, op verified their email and made the key discoverable.
- PaulDavisThe1st 3y ago
  So that implies that either the OP has forgotten that they did this (because they are quite clear that they did not), or that there is a way to do this without being the owner of the email address. Both worrying, but one is a lot more worrying than the other.
  - Valodim 3y ago
    I don't think they are clear they did not? In fact, they are clear that they did publish their key, because they mention depublishing it to test their hypothesis. The part they say they didn't opt into was that Proton (or any specific email client) would use the key by default.
    - PaulDavisThe1st 3y ago
      Indeed, you are correct, and I was wrong.

lxgr 3y ago

Even publishing a key as “searchable by email” should absolutely not be taken as an invitation by any client to encrypt by default, given the somewhat lacking ergonomics of GnuPG. I have a key published, but if somebody emails me encrypting to it, it would take me days to figure out where my smart card storing the private key is, how to use it on my current OS etc.

brewdad 3y ago
I'd probably be more sunk. When I was first learning and playing around with PGP, I published a key. Later, I changed the key for some reason or other but no longer had a way to revoke the old one. I'm pretty any of them out there are expired by now but for a few years it absolutely was possible to send me unreadable mail.
- lxgr 3y ago
  I think they are only using the “email address verified keys” that these “new-style key servers” use, so you’d be able to at least revoke that binding as long as you can receive unencrypted emails to that address.

Valodim 3y ago

keys.openpgp.org operator here. It's definitely not a bug, we do not publish email addresses without verification. From our perspective, op verified their email and made the key discoverable.

PaulDavisThe1st 3y ago
So that implies that either the OP has forgotten that they did this (because they are quite clear that they did not), or that there is a way to do this without being the owner of the email address. Both worrying, but one is a lot more worrying than the other.
- Valodim 3y ago
  I don't think they are clear they did not? In fact, they are clear that they did publish their key, because they mention depublishing it to test their hypothesis. The part they say they didn't opt into was that Proton (or any specific email client) would use the key by default.
  - PaulDavisThe1st 3y ago
    Indeed, you are correct, and I was wrong.