This is probably a stupid question/vaguely defined, but I need to ask it anyway.
I want to put a public key for mail exchange on my website, such that even very powerful adversary with power to intercept and fiddle with traffic on both sides and DNS couldn't read e-mails mailed to me.
What I mean is that:
- the adversary shouldn't be able to do a MITM attack - that means, showing the sender (not me) a false key, intercepting the mail, reading it, re-crypting it, and sending it to me, encrypted with my original key
- the adversary shouldn't be able to do "reverse" MITM attack - that the sender signs the mail with his key, puts the signature there, but the adversary, when re-cyphering it, adds there a signature with his false key, and showing me the wrong one
- DNS is just for DKIM
- putting https on a webhosting is not secure too, because evil webhoster can fiddle with your files and serve the false keys to different IPs
So, the only solution that I see is to put the public key on your own server, that you control, with https.
So really, to just publish a public GPG key so you can be really sure any powerful adversary is not reading mails intended to you, you need to actually install your own hardware and software with HTTPS? That sounds a little exhausting, actually.