If keybase.io provides a modified public key, doesn't the client detect that by comparing a hash of the provided key to the "proof" hash posted elsewhere? e.g.

If keybase.io provides a modified public key, doesn't the client detect that by comparing a hash of the provided key to the "proof" hash posted elsewhere? e.g. In the situation commented above [1], your client would download the altered key from keybase.io, compute a hash, then download https://twitter.com/bob/tweets/1234 https://twitter.com/bob/tweets/1234 and extract THAT hash, then compare the two. The comparison would fail, and you would know that the key you received from keybase.io is not the same as the key that the tweet vouched for. [1] https://news.ycombinator.com/item?id=7465349 https://news.ycombinator.com/item?id=7465349