I love the idea of decentralized trust, the web of trust, and the fact that anyone can run their own keyserver and isn't beholden to a centralized point of failure. But does the decentralized "feature" of the web of trust and the keyserver network make it effectively broken as a method of trusting others? Take for example this criticism:
What bothers me about existing keyservers? I used the phrase "fundamentally broken" not to be all trashy, but because I think there's something broken in the fundamentals. The fundamentals involve PGP itself, and are perpetuated by the keyservers:
The web of trust is really dangerous. I love the idea in theory, but I've been to a key signing party with a whole bunch of smart programmers and it was a mess. It was confusing enough that I don't think I feel comfortable generally trusting most edges in the graph.
Anyone can claim to be any email address and push it to a keyserver. This produces pretty dangerous behavior, if you just choose to look up someone by email address (or get contacted by the impostor and look up by fingerprint.) A counterargument to this is of course that the web of trust will isolate this fake account, but I have sub-problems with this: (a) people may ignore the WoT, and (b) it's very easy for an impostor to get into the web of trust. As an example, it's easy for someone to show up at a key signing party with a fake ID. Not all keysigning parties are among people who know each other, and in fact, many happen at meetup type events.
This bothers me very much, because there is a lot of truth to this. The fact that anyone can post a key to a keyserver and it's automatically published (i.e. without verifying that they can receive email at all addresses associated with the key, and decrypt messages with that public key that is pushed to the keyserver) is a big problem. And the entire "web of trust" is based on our assumption that others who have signed keys within the web of trust are themselves trustworthy.
Are these elements of the PGP infrastructure inherently broken? Does the decentralized nature of trust and the keyserver network inherently allow for the infiltration of untrustworthy characters?