From 82215f63d8b2df1d4d08fcb04274b42278bb3223 Mon Sep 17 00:00:00 2001
From: Tom Ryder <tom@sanctum.geek.nz>
Date: Wed, 30 Oct 2013 11:32:46 +1300
Subject: Retrieve keys over hkps:// per RiseUp guide

<https://we.riseup.net/riseuplabs+paow/openpgp-best-practices#consider-making-your-default-keyserver-use-a-keyse>

The keyserver pool CA needs to be installed for this to work. On Debian:

    # curl https://sks-keyservers.net/sks-keyservers.netCA.pem \
        > /usr/local/share/ca-certificates/sks-keyservers.netCA.crt
    # update-ca-certificates
---
 gnupg/gpg.conf | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'gnupg')

diff --git a/gnupg/gpg.conf b/gnupg/gpg.conf
index 324a0f20..2173f954 100644
--- a/gnupg/gpg.conf
+++ b/gnupg/gpg.conf
@@ -4,8 +4,8 @@ default-preference-list SHA512 SHA384 SHA256 SHA224 AES256 AES192 AES CAST5 ZLIB
 default-recipient-self
 fixed-list-mode
 keyid-format 0xlong
-keyserver pgp.net.nz
-keyserver-options auto-key-retrieve
+keyserver hkps://hkps.pool.sks-keyservers.net
+keyserver-options auto-key-retrieve check-cert no-honor-keyserver-url
 list-options show-uid-validity
 no-greeting
 personal-digest-preferences SHA512
-- 
cgit v1.2.3