OR, you could use already well-established key servers, e.g. pgp.mit.edu. Why reinvent the wheel?
>Can you delete my key from the key server?
>No, we cannot remove your key from the key server. When you submit a key to our key server the key is also forwarded to other key servers around the world, and they in turn forward the key to still other servers. Deleting the key from our server would not cause it to be deleted from any of the other servers in the world and so this is not an effective way to ensure the discontinued use of your key.
I discovered the above the hard way when I was testing an Android app called OpenKeyChain, which creates your PGP key and, without telling you, uploads it to several keyservers for "convenience". Since I was testing the thing, I used a private e-mail and my name.
As a result, real name is now inextricably tied to that e-mail address through a keyserver that was ostensibly supposed to provide privacy...
Neither here nor there, but I mention it because the experience somewhat soured me on the idea of non-deletable keys.
You're publishing completely public information on the internet. Even in a world where key servers will delete your key that doesn't really help you when anyone has access.
The best you can do is mark your keys as invalid by submitting a revocation certificate.
> If you still have the private key, you can use your PGP software to generate a revocation certificate, and upload that to the keyserver. The exact procedure for generating a revocation certificate varies depending on what PGP software you are using, please consult the documentation for more information. This will not delete your key from the key server, but it will tell people who download it that the key has been revoked, and should not be used.
If you're annoyed that unpublishing something on the internet is futile there are a lot of government officials and celebrities who will sympathize with you.
I did attempt to contact the app developers about their app's behavior--unfortunately, the only method they provided was a mailing list, so, upon having my first attempt at being discrete blow up in my face, I decided that being forced to send an e-mail to a public mailing list in order to draw attention the fact that I had inadvertently de-masked myself just seemed like rubbing salt into a wound.
To boot, it seems like something of a stretch to put a privacy-conscious user who misconfigured (or was unaware what the default behavior was, in my case) his privacy app to be in the same boat as a G-man or a celebrity who took nude selfies, don'tcha think?
I think a much better system is using keybase (with your GitHub identity linked to keybase), and then checking the gpg signatures using git locally. GitHub's setup has no tangible benefits (if you can log in to an account and therefore can push to your own repositories and make pull requests as yourself, you can also change the trusted GPG keys). The only case where it might help is to show that a commit on someone else's repo isn't you. But surely that's something people already assume?
http://pool.sks-keyservers.net/pks/lookup?op=vindex&search=p...
Yes they do. It's called "the web of trust" and has existed for quite a long time.
The SKS keyserver pool was recommended instead.