From void at f-m.fm  Fri Oct  9 19:06:31 2026
From: void at f-m.fm (void)
Date: Fri, 9 Oct 2026 18:06:31 +0100
Subject: a question about keyservers
Message-ID: <askfF-S91CHZt_8_@int21h>

Hi,

It seems keys.openpgp.org and hockeypuck servers like keyserver.ubuntu.com
don't synch. What other keyservers synch or don't synch?

If you're going to publish your key, what servers do you publish to?

-- 

From andrewg at andrewg.com  Sat Oct 10 00:36:28 2026
From: andrewg at andrewg.com (Andrew Gallagher)
Date: Fri, 9 Oct 2026 23:36:28 +0100
Subject: a question about keyservers
In-Reply-To: <askfF-S91CHZt_8_@int21h>
References: <askfF-S91CHZt_8_@int21h>
Message-ID: <3EF32326-1E45-4C74-8FFF-280A35AC7DD1@andrewg.com>

On 9 Oct 2026, at 19:02, void via Gnupg-users <gnupg-users at gnupg.org> wrote:
> 
> It seems keys.openpgp.org and hockeypuck servers like keyserver.ubuntu.com
> don't synch. What other keyservers synch or don't synch?

There are many public keyservers (or keyserver systems), but the biggest ones are, in rough order of traffic:

keys.openpgp.org
keyserver.ubuntu.com
the SKS network
the.earth.li

…plus there are many smaller and/or unmaintained servers, but they generally serve a limited or stale set of keys.

(I’m defining a “public keyserver” as one that accepts keys from users in any email domain and using any software. There are other keyservers such as the proton keyserver that only serve keys for addresses in domains that they manage, and there are also some keyservers such as the mailvelope keyserver and the flowcrypt attester that serve keys for users of specific applications.)

You can see the current SKS network, which includes most public hockeypuck servers but not (for now) keysever.ubuntu.com, at https://spider.pgpkeys.eu/sks-peers - anything not in this list is not in full sync with the network.

But…

> If you're going to publish your key, what servers do you publish to?

I would recommend publishing primarily to the SKS network, because there is a bridge configured on several of the SKS nodes that forwards new or updated keys to keys.openpgp.org, keyserver.ubuntu.com and the.earth.li — to the best of my knowledge none of those are (yet) configured to send updates back to SKS but that may change soon.

I would also recommend publishing each key directly to keys.openpgp.org at least once, because it will not serve your key in response to an email lookup until you have responded to its verification email. This only needs to be done once, as subsequent updates should be picked up automatically.

Note also that the.earth.li operates an unusual antispam system where it only serves keys in the strong set, i.e. those that have third-party certifications over them made by keys already in its database. You don’t have to submit directly to it though.

A

From void at f-m.fm  Sat Oct 10 12:09:55 2026
From: void at f-m.fm (void)
Date: Sat, 10 Oct 2026 11:09:55 +0100
Subject: a question about keyservers
In-Reply-To: <3EF32326-1E45-4C74-8FFF-280A35AC7DD1@andrewg.com>
References: <askfF-S91CHZt_8_@int21h>
 <3EF32326-1E45-4C74-8FFF-280A35AC7DD1@andrewg.com>
Message-ID: <asoO88s4ADmhmXYb@int21h>

On Fri, Oct 09, 2026 at 11:36:28PM +0100, Andrew Gallagher wrote:

> loads of helpful stuff

Thank you very much for your thoughtful and detailed answer.
-- 

From dr_mortimer at disroot.org  Sun Oct 11 23:44:00 2026
From: dr_mortimer at disroot.org (dr_mortimer at disroot.org)
Date: Sun, 11 Oct 2026 23:44:00 +0200
Subject: a question about keyservers
In-Reply-To: <askfF-S91CHZt_8_@int21h>
References: <askfF-S91CHZt_8_@int21h>
Message-ID: <20261011234400.75224a35@laptopmx>

il giorno Fri, 9 Oct 2026 18:06:31 +0100
void via Gnupg-users <gnupg-users at gnupg.org> ha scritto:

> Hi,
> 
> It seems keys.openpgp.org and hockeypuck servers like keyserver.ubuntu.com
> don't synch. What other keyservers synch or don't synch?
> 
> If you're going to publish your key, what servers do you publish to?


Hi void, 

i'am italian and first of all j apologize for my poor english.

personally i have always used the keys.openpgp.org service without problems, perhaps
what you had may have been temporary difficulties.

greetings.

-- 
║ [ Dr.Mortimer ] ║  @ [ debian ] https://www.debian.org/ [ forky | testing ]
║ GNU     Project ║ -> [ https://www.gnu.org/    ]
║ Kernel Archives ║ -> [ https://www.kernel.org/ ]
║ GPG FingerPrint ║ -> [ 28BD 5BBC C225 F515 D1EB  33FC DE43 B8DB AE8D 07AD ]
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 659 bytes
Desc: Firma digitale OpenPGP
URL: <https://lists.gnupg.org/pipermail/gnupg-users/attachments/20261011/659541a4/attachment.sig>

From void at f-m.fm  Tue Oct 13 14:56:52 2026
From: void at f-m.fm (void)
Date: Tue, 13 Oct 2026 13:56:52 +0100
Subject: a question about keyservers
In-Reply-To: <20261011234400.75224a35@laptopmx>
References: <askfF-S91CHZt_8_@int21h>
 <20261011234400.75224a35@laptopmx>
Message-ID: <as4qlE_0gUECVc7d@int21h>

On Sun, Oct 11, 2026 at 11:44:00PM +0200, WinterMute via Gnupg-users wrote:

>personally i have always used the keys.openpgp.org service without problems, perhaps
>what you had may have been temporary difficulties.

Hi,

No it seems they don't talk to eash other 
(keys.openpgp.org <-> hockeypuck servers)
The key in question has been on hockeypuck (so, ubuntu.com, pgp.eu) 
for a long time.

-- 

From void at f-m.fm  Tue Oct 13 15:03:57 2026
From: void at f-m.fm (void)
Date: Tue, 13 Oct 2026 14:03:57 +0100
Subject: a question about keyservers
In-Reply-To: <as4qlE_0gUECVc7d@int21h>
References: <askfF-S91CHZt_8_@int21h>
 <20261011234400.75224a35@laptopmx>
 <as4qlE_0gUECVc7d@int21h>
Message-ID: <as4sPcpIppWrLBEJ@int21h>

On Tue, Oct 13, 2026 at 01:56:52PM +0100, void via Gnupg-users wrote:
>On Sun, Oct 11, 2026 at 11:44:00PM +0200, WinterMute via Gnupg-users wrote:
>
>>personally i have always used the keys.openpgp.org service without problems, perhaps
>>what you had may have been temporary difficulties.
>
>Hi,
>
>No it seems they don't talk to eash other (keys.openpgp.org <-> 
>hockeypuck servers)
>The key in question has been on hockeypuck (so, ubuntu.com, pgp.eu) 
>for a long time.

For example, your public key is on hkps://keys.openpgp.org but it's
not on hkps://keyserver.ubuntu.com or hkps://pgpkeys.eu or 
hkps://the.earth.li
-- 

From dr_mortimer at disroot.org  Thu Oct 15 01:37:25 2026
From: dr_mortimer at disroot.org (dr_mortimer at disroot.org)
Date: Thu, 15 Oct 2026 01:37:25 +0200
Subject: a question about keyservers
In-Reply-To: <as4sPcpIppWrLBEJ@int21h>
References: <askfF-S91CHZt_8_@int21h>
	<20261011234400.75224a35@laptopmx>
	<as4qlE_0gUECVc7d@int21h>
	<as4sPcpIppWrLBEJ@int21h>
Message-ID: <20261015013725.7df60e32@laptopmx>

il giorno Tue, 13 Oct 2026 14:03:57 +0100
void via Gnupg-users <gnupg-users at gnupg.org> ha scritto:

> For example, your public key is on hkps://keys.openpgp.org but it's
> not on hkps://keyserver.ubuntu.com or hkps://pgpkeys.eu or 
> hkps://the.earth.li


hi void, 

Now what you meant is completely clear to me, unfortunately i can't tell you if this
behavior is "normal" or if there is some dysfunction going on.

perhaps it could be useful to check on the respective websites of the services if
there is any information in this regard... in case you haven't already done so of
course.

greetings.

-- 
║ [ Dr.Mortimer ] ║  @ [ debian ] https://www.debian.org/ [ forky | testing ]
║ GNU     Project ║ -> [ https://www.gnu.org/    ]
║ Kernel Archives ║ -> [ https://www.kernel.org/ ]
║ GPG FingerPrint ║ -> [ 28BD 5BBC C225 F515 D1EB  33FC DE43 B8DB AE8D 07AD ]
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 659 bytes
Desc: Firma digitale OpenPGP
URL: <https://lists.gnupg.org/pipermail/gnupg-users/attachments/20261015/199a2499/attachment-0001.sig>

From anton.txt at gmail.com  Mon Oct 19 12:27:52 2026
From: anton.txt at gmail.com (Anton Shepelev)
Date: Mon, 19 Oct 2026 13:27:52 +0300
Subject: a question about keyservers
References: <askfF-S91CHZt_8_@int21h>
Message-ID: <20261019132752.b75d80cb9e78094cee7355a5@gmail.com>

void:

> It seems keys.openpgp.org and hockeypuck servers like
> keyserver.ubuntu.com don't synch. What other
> keyservers synch or don't synch?

I think you'll have to ask the maintainers for those
servers, or at least consult their communties to find
that out.

I should also observe that WKD/WKS is generally
considered a better alternative to centralised key
servers, as it is less vulnerable to key-spamming
attacks:              <https://wiki.gnupg.org/WKD> .
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 659 bytes
Desc: not available
URL: <https://lists.gnupg.org/pipermail/gnupg-users/attachments/20261019/30d592b5/attachment.sig>

From andrewg at andrewg.com  Mon Oct 19 20:36:42 2026
From: andrewg at andrewg.com (Andrew Gallagher)
Date: Mon, 19 Oct 2026 19:36:42 +0100
Subject: a question about keyservers
In-Reply-To: <20261019132752.b75d80cb9e78094cee7355a5@gmail.com>
References: <askfF-S91CHZt_8_@int21h>
 <20261019132752.b75d80cb9e78094cee7355a5@gmail.com>
Message-ID: <c1d7bb52-433d-4117-ba89-89f8d8ecac0b@andrewg.com>

On 19/10/2026 11:27, Anton Shepelev via Gnupg-users wrote:
> 
> I should also observe that WKD/WKS is generally
> considered a better alternative to centralised key
> servers, as it is less vulnerable to key-spamming
> attacks:              <https://wiki.gnupg.org/WKD> .
WKD is generally better for the following use case:

1. example.com's domain admins support PGP
2. Bob does not already have a key for alice at example.com

Bob can then use example.com's WKD server to find a plausible key for 
Alice. This avoids a lot of spam issues, but at a price:

1. Relatively few domains run a WKD server
2. A lot of trust is placed in the email-domain admins
3. Alice (or an attacker who compromises her account) can prevent 
distribution of updates (such as third-party revocations)

If the email provider is part of your threat model, or is just being 
uncooperative, then WKD doesn't help much.

The key advantage of public keyservers is that they will distribute 
updates for anyone's key, and many keyservers (such as keys.openpgp.org) 
have strict antispam protections.

So I would normally recommend using both WKD and public keyservers, 
wherever possible.

A


From wk at gnupg.org  Wed Oct 21 08:39:18 2026
From: wk at gnupg.org (Werner Koch)
Date: Wed, 21 Oct 2026 08:39:18 +0200
Subject: a question about keyservers
In-Reply-To: <c1d7bb52-433d-4117-ba89-89f8d8ecac0b@andrewg.com> (Andrew
	Gallagher via Gnupg-users's message of "Mon, 19 Oct 2026 19:36:42
	+0100")
References: <askfF-S91CHZt_8_@int21h>
	<20261019132752.b75d80cb9e78094cee7355a5@gmail.com>
	<c1d7bb52-433d-4117-ba89-89f8d8ecac0b@andrewg.com>
Message-ID: <87jynbwoa1.fsf@jacob.g10code.de>

On Mon, 19 Oct 2026 19:36, Andrew Gallagher said:

> updates for anyone's key, and many keyservers (such as
> keys.openpgp.org) have strict antispam protections.

And because of this they are SPo*s and contradict the decentralized (aka
fediversed) nature of PGP.  The best anti-spam and avoind of wrong usage
method would be to disallow any search by user-id and only allow
retrieval by fingerprint - maybe even just for revocation.  Key
distribution can be done peer to peer with a simple signed mail.


Salam-Shalom,

   Werner

-- 
The pioneers of a warless world are the youth that
refuse military service.             - A. Einstein
-------------- next part --------------
A non-text attachment was scrubbed...
Name: openpgp-digital-signature.asc
Type: application/pgp-signature
Size: 284 bytes
Desc: not available
URL: <https://lists.gnupg.org/pipermail/gnupg-users/attachments/20261021/88da1f83/attachment.sig>

From rjh at sixdemonbag.org  Wed Oct 21 14:46:47 2026
From: rjh at sixdemonbag.org (Robert J. Hansen)
Date: Wed, 21 Oct 2026 08:46:47 -0400
Subject: a question about keyservers
In-Reply-To: <87jynbwoa1.fsf@jacob.g10code.de>
References: <askfF-S91CHZt_8_@int21h>
 <20261019132752.b75d80cb9e78094cee7355a5@gmail.com>
 <c1d7bb52-433d-4117-ba89-89f8d8ecac0b@andrewg.com>
 <87jynbwoa1.fsf@jacob.g10code.de>
Message-ID: <0eefd246-0f1a-4de5-a1fe-d928ae17f4f8@sixdemonbag.org>

> And because of this they are SPo*s and contradict the decentralized (aka
> fediversed) nature of PGP.

Can't agree here. The great virtue of OpenPGP/LibrePGP is that it 
doesn't really have a governing philosophy: rather, it provides the 
definitions, data formats, and protocols for people to assemble a 
cryptographic solution that dovetails with their governing philosophy.

Is it possible to use *PGP in a federated way? Absolutely. But it's in 
no way necessary to use the protocol, which works fine with centralized 
key distribution.

To be clear, I'm not objecting to Werner's characterization of sites 
like keys.openpgp.org being single points of failure. I'm objecting to 
the idea decentralization is a core part of *PGP, as opposed to it being 
just another capability that can be used or discarded as the situation 
demands.



From anton.txt at gmail.com  Wed Oct 21 17:48:39 2026
From: anton.txt at gmail.com (Anton Shepelev)
Date: Wed, 21 Oct 2026 18:48:39 +0300
Subject: a question about keyservers
References: <askfF-S91CHZt_8_@int21h>
	<20261019132752.b75d80cb9e78094cee7355a5@gmail.com>
	<c1d7bb52-433d-4117-ba89-89f8d8ecac0b@andrewg.com>
	<87jynbwoa1.fsf@jacob.g10code.de>
	<0eefd246-0f1a-4de5-a1fe-d928ae17f4f8@sixdemonbag.org>
Message-ID: <20261021184839.a56d74606293da3a3e493e0d@gmail.com>

Robert J. Hansen:

> To be clear, I'm not objecting to Werner's
> characterization of sites like keys.openpgp.org being
> single points of failure. I'm objecting to the idea
> decentralization is a core part of *PGP, as opposed to
> it being just another capability that can be used or
> discarded as the situation demands.

I am with Werver on this one: It is by desing that PGP
works locally offline, with no requirements for a data
exchange protocol, which may happen by any internet
channel, or physically, when a you pass a piece of paper
to another person.

Futhermore, all data exchage can take place on a point-
to-point basis, without any intermediary whatsoever.
Therefore, I see keyservers as a centralised
superstructure put on top of the decentralised PGP
basis.  PGP works with any centralised third-party
services exactly because it is decentralised by nature.

Conversely, you cannot put a decentralised
superstructure on top of a centralised system.

-- 
()  ascii ribbon campaign -- against html e-mail
/\  www.asciiribbon.org   -- against proprietary attachments
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 659 bytes
Desc: not available
URL: <https://lists.gnupg.org/pipermail/gnupg-users/attachments/20261021/6ed7e8d7/attachment.sig>