3 ms·
If you don't mean to publish your keys, you'd be better off backing them along with your other files rather than uploading it to a public keyserver.
by soraminazuki 3y ago
If you don't mean to publish your keys, you'd be better off backing them along with your other files rather than uploading it to a public keyserver.
- lxgr 3y agoI don't mind publishing my keys at all, and in fact for some of my applications it makes GPG much more ergonomic to use. I do mind software or services taking that as an implicit statement of "go ahead, encrypt email to me using this" when it can clearly cause confusion and irrecoverable messages in many cases. That said, we don't actually know if Protonmail really does search all keyservers (including the "old-style" ones, i.e. the ones where anybody could publish anything in an unverified manner and the "web of trust" is used to figure out which key is in fact trusted), or only the new ones that perform email verification. If it's the latter, I think performing email verification could be considered a bit more of an opt-in statement to receiving encrypted mail.