If I Google for
inurl:http+keyserver, on the first 10 pages of hits I can find these:
And these are only the www based keyservers. Do they have zero clue about IT Security? HTTPS isn't a holy grail, but it is much better than plaintext! Correct setup of HTTPS requires that HTTP isn't enabled (at least a redir!) and a valid HTTPS cert...
Question: Why isn't its mandatory for the keyservers to be only available via HTTPS? Todays Let's Encrypt is free and requires no maintenance. Is there any good argument for not using a secure (encrypted and authentical) connection?
UPDATE: during a MiTM, the keys that are not sent via HTTPS can be altered, thus it doesn't matter that anybody can upload keys to keyservers, the whole thing is already lost! HTTPS would need to be mandatory! At least a better chance!