> Fluidkeys automatically fetches keys based on the verified email address and encrypts the secret to the key.
Fetches from where? Public key servers?
Anybody can upload a key for you@your-company.com to a public key server.
Fetches from where? Public key servers?
Anybody can upload a key for you@your-company.com to a public key server.
> We chose not to use the public keyserver network until it supports deleting keys and cryptographic validation.
... as well as the fact that there's no email validation, yep!
Gpg supports looking up keys via this since 2.1.12 [2]. An example of how to lookup and get a key this way can be seen here [3].
[1] https://tools.ietf.org/html/draft-koch-openpgp-webkey-servic...
[2] https://wiki.gnupg.org/WKD
[3] https://lists.gnupg.org/pipermail/gnupg-devel/2018-June/0338...
But mostly teams control their own mail domain, so they can do what they like (for example, use Fluidkeys, and we'll do WKD for them!)
We've got WKD working on our own hello@fluidkeys.com email address using a rather cheeky hack[1].
Server side, we're adding this to Fluidkeys Server soon.
That way, teams that use Fluidkeys could redirect `<team-domain>/.well-known/openpgpkey/(.*)$` to our server, and voila, we'll serve their keys via WKD