According to the PGP network FAQ
While a number of key servers exist, it is only necessary to send your key to one of them. The key server will take care of the job of sending your key to all other known servers.
Quite convenient. Let's say Bob, despite the advice above, decides to upload his public key to two servers at the same time - one of which is compromised. The user has confidence in both servers and doesn't check if the key hasn't been changed. He signs off for the day.
At some point the servers will propagate the keys and a collision will occur. One of the following will happen:
- The server will accept both keys (most likely)
- The newest key will be rejected
- The servers will "vote" on what they believe is the valid key (least likely)
Bob can now revoke the key he uploaded whenever he wants, however assuming (1) above, the false key will stay with the server indefinitely.
My question: Is there a way for a user to validate the correct key to the other (honest) servers? Perhaps sending a signed email with the correct key? Or is there another conflict resolution system?
Correction: When I say "conflict" I mean two public keys corresponding to the same email address.