Imagine alice posts her public PGP key on her website and bob encrypts a widget with that public key then sends it to alice over Tor. If alice's key is widely and publically available and an attacker were to keep a map of key => identity, wouldn't the attacker, if operating your entrance node, be able to correlate the IP of the sender to alice's identity by identifying the key it's encrypted with (even if she's using Kali Linux for anonymizing her IP - I assume that doesn't completely hide your identity if someone cares enough to know)? I assume here that a Tor server can identify a sender that is not likely a Tor server by simply keeping track of common sender IPs or by other clever means. Does the Tor protocol somehow protect from this? Have ways been explored to separate the identity of the public PGP key from the data it encrypts?
So your question is basically:
wouldn't the attacker, if operating your entrance node, be able to correlate the IP of the sender to [the recipient's] identity by identifying the key it's encrypted with
No because the entrance node does not know this key. In short, the Tor client encrypts the traffic before it is sent to the entrance node and the entrance node cannot read it. To understand why, you need to know a little about how Tor works:
Your Tor client selects three nodes: the entrance, middle and exit node. Each Tor node has its own public key and identifier. Let's say the entrance node has identifier 0xC4, the middle node has 0x13 and the exit node has 0x37. Say we want to transmit
Your Tor client would first encrypt
Message and the destination
alice.example.net with the exit node's public key, let's say this becomes
Your Tor client now encrypts this encrypted packet,
eu3AeShuC, a second time (using the public key from the middle node), adding the new destination: 0x37. The packet is now
And finally your Tor client encrypts this data a third time together with yet another destination (0x13), using the entrance node's public key. This becomes
egoo4eiReeth2Ief. The client sends this final packet to the entrance node.
The entrance node receives
egoo4eiReeth2Ief, decrypts it with its private key, and gets
ho7cieRaqhe and destination 0x13. It forwards the message to 0x13.
0x13, the middle node, receives it and decrypts the packet using its private key. It gets
eu3AeShuC and finds another destination: 0x37. It gets forwarded to 0x37.
Finally the exit node receives it, decrypts it with its private key, sees
Message and the destination
alice.example.net, and sends it there. This, by the way, is why you'll want to use https when accessing public websites (.onion is different) or PGP when sending e-mail: the exit node sees what goes out to the Internet.
This is of course a simplified model but it does tell us what each node knows: the entrance node knows your IP address, so it can correlate your IP address between packets and maybe even visits. But it has no idea what you are sending or to whom you are sending.
The middle node never has a clue about anything. Poor boy.
The exit node sees what you're sending, if it's not encrypted (such as with https) and whom you're sending to, but has no clue where it came from. Of course if you use the same PGP signature identity every time, the exit node would be able to see this identity, but isn't the point of a signature that it proves that it was you, even if "you" here is a pseudonymous (not anonymous) person?
Take an example of Tor and PGP: Satoshi Nakamoto used Tor and PGP. He proves his identity by PGP but hides his physical location (and thereby real-world identity) by using Tor. I do not believe anyone on the planet knows who Satoshi Nakamoto is if he (or she, or they) didn't want them to know. Tor is pretty good at anonymity if you use it properly and it seems Satoshi Nakamoto did.