Facebook allows users
to add OpenPGP public keys to their profile; these keys can be used to "end-to-end" encrypt notification emails sent from Facebook to your preferred email accounts. – Securing Email Communications from Facebook
Facebook provides a public key (0x2F3898CEDEE958CF) at https://www.facebook.com/facebook/publickey/download/
“encrypted notifications” regarding my account have been sent to me repeatedly via email from Facebook (firstname.lastname@example.org). These emails are encrypted with my public key, that I have uploaded to Facebook. These emails are signed with a key (0x3028CF59770E7A01) which is not the one provided by Facebook (0x2F3898CEDEE958CF). When I try to import the key 0x3028CF59770E7A01 with Enigmail the following notification is displayed:
The key with ID 0x3028CF59770E7A01 is not available on the keyserver. Most likely, the owner of the key did not upload their key to the keyserver.
Please ask the sender of the message to send you their key by email.
- I have found no way to contact the sender of the message.
- I have found no source for the key 0x3028CF59770E7A01.
My main question: How can I verify the email signature from Facebook?
And by the way: Why would Facebook use a key that produces a signature that can not be verified?
sub rsa4096/3028cf59770e7a01 2019-07-08T16:09:07Z sig sbind 2f3898cedee958cf 2019-07-08T16:09:07Z ____________________ 2020-01-04T20:00:00Z 
This is in accordance with the information provided by Facebook in their post Securing Email Communications from Facebook
Facebook's OpenPGP key comprises a long term primary key with short term subkeys; this allows us to frequently rotate our operational keys whilst maintaining the web of trust and a consistent identity over time.
However this subkey apparently is not public and attempts to receive this missing key from a keyserver fail.
gpg: Signature made Di 06 Aug 2019 17:56:19 CEST gpg: using RSA key 3B6C6808FC9D75EDAE0184E73028CF59770E7A01 gpg: Can't check signature: No public key