Maybe someone who knows the GDPR better could say whether there are exceptions for essential services. When looking up a public key by username, securing that mapping by username is clearly essential. Without it, you don’t have a secure service.

It would be like setting up certificate transparency without logging domain names - no point.