One of the options for security.txt is to include a reference to a PGP key for use when reporting vulnerabilities in a private, secure way. It makes perfect sense to me for a researcher to use PGP to encrypt a message to report a vulnerability.
But what about the business on the other end? How should they safely implement a PGP key for such reports?
One option would be to simply use one person's personal (or, more likely, a one-off created exclusively for this purpose) key, but then there is a risk that the person will die (unavailability) or turn rogue (DOS/MitM reports).
Another option would be to generate a key pair for this purpose and share it among a group of trusted individuals. This solves the "death" problem and the DOS problem, but it expands the risk of one person receiving a report and doing something nefarious with it.
A shared key also means that any private-keyholder can issue a message "as" that identity. This can probably be solved by making it clear that the key is for "receipt-only" when minting it.
Is there a standard and/or safe way to do things like this?