Key Server
In August 2019 GPG Suite switched to https://keys.openpgp.org/ as default key server. In June 2019 an attack was discovered targeting the now deprecated sks key servers. In that attack a large number of signatures was added to a key and uploaded to the key servers, rendering those keys unusable. Downloading such a "poisoned" key could corrupt the gpg setup and result in crashes in GPG Mail or GPG Keychain.
Why the new key server?
https://keys.openpgp.org allows for improved privacy control for users and avoids problems encountered in the past:
- improved performance
- search always returns a single key
- email addresses are only published with consent of the key owner after verification of email ownership
- keys can easily be removed from the server by the key owner
Using the new key server
Search is done by searching for an email address, searching for names is no longer supported.
In GPG Keychain > Settings > Key server users can tick an option to continue key search when no match was found on the new key server. In that case the search will continue on https://keyserver.ubuntu.com (Ubuntu's Hockeypuck keyserver).
See also: Key Upload and Verification