4 ms·
Don't upload your key to a public keyserver with an email address you have to verify you don't want to receive encrypted things with. That is the opt-in! Usual
by Avamander 3y ago
Don't upload your key to a public keyserver with an email address you have to verify you don't want to receive encrypted things with. That is the opt-in!
Usually the problem is the exact opposite, it's really annoying to find someone's public key even if they have given you the key ID or mentioned they can receive such mail.
- rakoo 3y agoThat a key exist on a random keyserver means nothing. There is a spec that explicitely says "if you want to use my key here it is" and Proton doesn't respect it. what does it mean that you found the key on some third-party domain ? There are 0 safeguards, I don't know what they're going to do with it, there is no obligation from any side. A key in keys.openpgp.org means nothing.
- Avamander 3y agoIt means someone uploaded it there and verified the address in the identity (or subidentity). A keyserver is exactly for "here's my key, use it". Don't publish your keys if you don't want them used. It's not that difficult.