Is there flag or something in an openPGP key that can be used to communicate my wish that this key should never be uploaded to a keyserver?

If not, can I create a key that is broken in such a way that it won't be accepted by a keyserver, but can still be used for normal encrypt and signing operations?

I know this behaviour breaks many aspects of the web of trust but I don't like the idea of spammers gathering my E-mail address from public keyservers.


No, it is not possible, and there is no flag to indicate you don't want your key uploaded.

What you could do is:

  • Include such information in a UID, but you can't be sure nobody will upload it anyway (even by accident)
  • Use a "hidden" mail address like john.doe-at-example.com, but this will break automatic use of the correct mail address and spammers are possibly able to parse these
  • Not giving any mail address in your key. Same problems like when hiding it, but definitely nobody will be able to parse it. The key can be used for encryption/signing anyway, but expect hassles with OpenPGP clients.

Probably it is more easy to accept spam and filter it. With some advanced filters, you could use a separate mail address and filter out all mails not containing any OpenPGP-packets.


There's nothing you can do to prevent this, because there is nothing to stop someone creating a new key with your email address and uploading that (though PGP Global Directory does actually verify the email address by mailing it). Similarly there's nothing you can do to prevent someone posting your email address on a forum or putting it on a billboard.

I think a rogue acquaintance adding your key to a keyserver is probably one of the less likely ways of it getting onto a spammers list, but (in my opinion) the most effective way to prevent this would be a note alongside any way in which your publish your key explaining your wishes.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.