If you are concerned about leaking your associations via public key signatures, you could use (and request that your contacts use) local/non-exportable signatur

If you are concerned about leaking your associations via public key signatures, you could use (and request that your contacts use) local/non-exportable signatures. That way you will be able to keep track of your trusted keys locally, but your signatures (and the associated metadata about your contacts) cannot be exported, either directly or to a keyserver. You can do this with `gpg --lsign-key`. Enigmail also exposes this option in their GUI, as a checkbox in the "Sign Key" dialog. Of course, this reduces the utility of the web of trust, but within the current design of PGP this tradeoff is inevitable.