Do you auto fetch GPG keys?

[Chris Willard <chris@xxxxxxxxxxxxxxxxx>]

Hi All,

I have just installed GPG to use with Mutt.

There seem to be 2 opinions regarding the automatic downloading of keys
from key servers. Some say that it is OK and others think that it is a
security risk!

From what I understand if I download a key then I know that a message I
receive has been signed or encrypted by the key but I can not be sure
that the key is from the person due to man in the middle attacks?

From what I have read it is OK to download but then to be sure that the
key is actually from the intended recipient we need to confirm our key
fingerprints.

Any opinions on these would be appreciated as I am not sure to download
keys or not at the moment!

Regards,

Chris


-- 
/*       _\|/_
         (o o)
 +----oOO-{_}-OOo-----------------------------------+
 |Chris Willard <chris@xxxxxxxxxxxxxxxxx>           |
 |                                                  |
 |My guru said there would be lifetimes like this...|
 |                                                  |
 +-------------------------------------------------*/