This page is absolutely correct that you should not use 32 bit key IDs, ever. However, some of its information about GnuPG is out of date. As of version 1.4.17

This page is absolutely correct that you should not use 32 bit key IDs, ever. However, some of its information about GnuPG is out of date. As of version 1.4.17 (released in June), GnuPG no longer blindly accepts responses from key servers: http://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=commit;h=5230304349490f31aa64ee2b69a8a2bc06bf7816 http://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=commit... http://bugs.g10code.com/gnupg/issue1579 http://bugs.g10code.com/gnupg/issue1579 The fix was backported to wheezy-security as well: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725411 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725411