As some of you may have read:
or other media reports about vulnerabilities of the current gpg
TLDR: Someone can (and has been) flooding sks keyservers with poisoned
certs. Users that download from sks keyservers may well find gpg just
stops working, hangs, or breaks in terrible ways. The SKS software is no
longer maintained and because the policy is 'never delete anything'
there's likely no way to mitigate the attacks.
I've cc'ed nb here for his take on things, but as I read it, it might be
best to just retire the keys.fedoraproject.org
service at least for now
to avoid breaking users or telling them we have a service they should
trust when they really... should not.