PGP

I am actively using the following PGP key with the given fingerprint and underlined key ID1:

You can directly obtain a snapshot (2020-10-11) of my keys here from my website, with all the signatures included:

The signatures are relevant when using the web of trust as a trust model. Note that there is no central authority for PGP, like for the centralized trust model of X.509 certificates.

Keyservers. Alternatively, you can go to one of the many PGP keyservers and search for all keys containing my UID or for my specific key:

However, you should really check the fingerprint when you download the key from a keyserver! Do not only check the short (8-digit) key IDs, because it is easy to maliciously create multiple keys with colliding short IDs, and it has happened in practice.

SKS versus keys.openpgp.org. SKS keyservers suffer from multiple problems that have been known in theory for a long time and became reality in recent years. Besides intentionally creating keys with colliding short IDs, there are certificate flooding attacks resp. certificate spamming attacks that can break your GnuPG installation. Consequently, keyservers need to be treated with care in these days.

In June 2019, keys.openpgp.org launched a keyserver that requires e-mail verification for submitted keys to resolve the problems mentioned above. However, as part of the solution this keyserver removes (third-party) signatures and therefore effectively prunes the web of trust. However, they may come back at some point by requiring cross-signatures. Also, this service cannot be part of the SKS pool for the same reasons. And only one key is stored per e-mail address.

  1. The ID of a PGP key is simply a suffix of the 160 bit (40 hex digits) fingerprint. ↩