When I download PGP keys from keyservers like so:
gpg --search-keys email@example.com
How are the public keys transferred down to my machine? Is there a possibility of a MITM attack to serve me the wrong key?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
If you use the signatures on the key to validate it (such as the web of trust model), then you only depend on the key material you have, and not the key served to you. In fact, if you know the fingerprint of the key you want (with certainty) you can just verify the fingerprint after retrieving it.
If you want to avoid a MITM, you can use the hkps protocol described on the SKS Keyserver page here: https://sks-keyservers.net/overview-of-pools.php.
Keep in mind that anyone can upload any key to the keyserver, so just because it has the email you want doesn't mean it's the right key. Only the signatures on the key (and the trustworthiness of the signatures) can help determine if the key you have is the legitimate one.