> (ie, fetching keys from keyservers, encrypting automatically, etc)
No no no no no! The keyservers have no authentication for key addition. Anybody can put up a key for any email address and effectively wedge themselves man in the middle.
No no no no no! The keyservers have no authentication for key addition. Anybody can put up a key for any email address and effectively wedge themselves man in the middle.
If _I_ were involved with PRISM, the pipe running to pgp.mit.edu would be one of the most monitored connections around. "Hmmm, someone just searched for a PGP key for FedRegister - lets see what else that IP address has searched for, and what's in all the gmail inboxes that have ever been accessed using that IP address…"
Yes, I redact my above comment to remove that example.
However, I still stand by my statement that PGP UX is a client issue, not an inherent protocol issue (ie, it's fixable without abandoning PGP entirely).