Lets say that I have a situation where a friend of mine has my OpenPGP public key(which is publicly visible on a web page, but I handed it him personally on a piece of paper), I do not know his public key and I need to send encrypted data to him. This means that I need to get his public key in a secure manner so that I can encrypt data with his public key. All the communication needs to happen over e-mail.
At first I thought that he simply encrypts(not for hiding but for ensuring that his public key is not changed during the transmission) his public key with my public key and sends it to me with an e-mail, but actually this does not work because in case of MiT attacker could replace the original e-mail with a forged one and also encrypt it with my public key. In other words it is not possible for me to tell that the public key I received is actually my friends public key.
Am I correct that there is no other solution to this other than I need to get his public key on a piece of paper, I verify his public key through a trusted introducer(e.g. a Certification Authority), etc?
