Is there a standard method for searching and importing a pgp key using curl or wget?
I was going through verifying the download with a gpg signed shasum256 file and encountered the problem of trying to verify the gpg fingerprint.
So the standard method is to use
gpg --recv-key KEYID that is shown when
gpg --verify <file>.asc <file> is run, to auto import the public key from the public synchronizing key servers. But gpg now runs as an agent, and uses dirmngr to mediate this transfer. Unfortunately, dirmngr has never been able to honour the use of web proxies and so i'm left with trying to search and download using a web service and curl.
Doing this using a pool of key servers, results in added assurance that the keyfile you're downloading is legitimate across this pool. But this can be also be done if the user downloads the keyfile using https across multiple managed key service providers and verifies that the keyfiles are similar across board.
So are there sites with rest endpoints that i can call with just the keyid and get nice ascii armored results?