History of PGP keyservers and the pgp.net network

Updated November 2026

Public keyservers began in the early 1990s as volunteer email robots. They grew into a worldwide pool of servers that kept each other in sync. That pool ended in 2021, two years after an attack showed that its "never delete anything" design could be abused. Today the main services are keys.openpgp.org, Hockeypuck servers such as keyserver.ubuntu.com, and Web Key Directories run by mail domains.

Milestones in public key distribution (dates verified in the sources below).

Email keyservers (early 1990s)

The first public keyservers answered email. You sent a command such as GET alice in the Subject line, and the server mailed the key back. The email keyserver page explains the commands. The software was written by Michael Graff at Iowa State University. A server list he kept, last updated on June 13, 1994, names volunteers in the US, the UK, the Netherlands, Germany, Japan, Australia, Italy, South Africa and the Soviet Union's .su domain. Several were run by universities, such as MIT, Oxford, Tilburg, Hamburg and Milan.

The same list shows the legal climate of the time. Several US servers accepted only keys made with PGP 2.4 or later, and the list said this was "because of legal reasons". It also told users to watch the Usenet group alt.security.pgp for news of new sites.

The pgp.net domain

The domain pgp.net was registered on December 15, 1994. The announcement of the email service says it was registered "last year", so it was written in 1995. The goal was one stable naming scheme for PGP infrastructure, in the form service[.region].pgp.net, instead of addresses tied to one machine at one university. The first names were the email keyserver keys.pgp.net plus ftp.pgp.net and www.pgp.net.

keys.pgp.net was a set of equal-priority MX records. Mail went to a random member server, and if one was down the next one was tried. The announcement lists four national domains at the start:

The first national keys.*.pgp.net domains (1995 announcement)
Domain	Country	Server run by
keys.de.pgp.net	Germany	DFN-CERT
keys.no.pgp.net	Norway	University of Tromsø
keys.uk.pgp.net	United Kingdom	OxCERT, Oxford
keys.us.pgp.net	United States	MIT

The announcement names six people who set it up: Piete Brooks (University of Cambridge), Borge Brunes (University of Tromsø), Klaus-Peter Kossakowski (DFN-CERT), Brian LaMacchia (MIT), Paul Leyland (OxCERT) and Teun Nijssen (CERT-NL). It also noted that more and more keyservers were run by computer emergency response teams (CERTs), which had a reason to keep them reliable.

A charter dated February 28, 1996 set the rules for joining. Member servers had to return the standard help text, synchronize with other pgp.net servers and send replies from their own address. By early 1998 the email service had help texts in 15 languages and 16 national domains. The FTP archive was mirrored in Austria, Australia, Switzerland, Germany (Hamburg, Paderborn and Berlin), Japan, Norway, Poland, Sweden, Taiwan and the UK, according to its January 1998 README. The help text of March 1997 counted more than 55,000 keys in an 18 MB key ring. Copies of all these documents are in the archive.

Web keyservers, PKS and HKP

Email lookups were slow. Brian LaMacchia (known as "BAL") built a web interface to the MIT keyserver, and the pgp.net pages of 1996 point to it alongside clones in Barcelona, Cambridge, Tromsø, the Netherlands, Paderborn and Korea. In 1995 an archived proposal, rem.html, already argued that the single replicated key ring was "creaking" and that a distributed service would be needed.

The next step was PKS, the public key server written by Marc Horowitz at MIT. Its web interface became the standard that servers still use: requests to the /pks/lookup path, by convention on TCP port 11371. That interface is called the HTTP Keyserver Protocol (HKP). David Shaw's first Internet-Draft describing HKP, from March 2003, says it formalizes the HKP "originally implemented in the PKS keyserver by Marc Horowitz". The draft adds that PKS was "based on earlier work by Brian LaMacchia and Michael Graff." pgp.net ran a "PGP 5.0 compatible" server on port 11371 under names such as wwwkeys.pgp.net, wwwkeys.eu.pgp.net and wwwkeys.de.pgp.net. The HKP page explains the protocol.

SKS: the synchronizing keyserver

SKS became the software of the main public keyserver network. Yaron Minsky wrote it to show off a fast set-reconciliation algorithm from his PhD research. Two servers can find the few keys they do not share by exchanging data roughly the size of the difference, instead of comparing whole databases. By September 27, 2002 Minsky was explaining on the keyserver operators' mailing list how SKS's reconciliation worked. In October 2003 the project moved to the Savannah hosting site with a new mailing list. An early release also added PKS-style email synchronization, so SKS could still exchange keys with older servers.

SKS is written in OCaml. By design it never deletes a key or any part of one. Servers sync with each other, so a deletion on one server is undone by the others. Revoking a signature only adds another signature. The idea was to resist censorship. In practice it meant nobody could remove spam, personal data or broken keys. MIT's pgp.mit.edu still says it runs SKS, and its FAQ explains that it cannot remove keys.

The best-known way to reach SKS was the pool at pool.sks-keyservers.net. Its website was developed and hosted by Kristian Fiskerstrand. It listed healthy servers and handed out their addresses through DNS.

The 2019 certificate flooding attack

In the last week of June 2019, unknown attackers added huge numbers of fake third-party signatures to the public certificates of two well-known OpenPGP contributors: Robert J. Hansen and Daniel Kahn Gillmor. Hansen's certificate ended up with nearly 150,000 signatures. The OpenPGP standard sets no limit on signatures per certificate, but GnuPG slows almost to a halt when it processes such a certificate. Importing one could leave an installation hard to use. Because SKS cannot delete anything, the "poisoned" certificates could not be cleaned off the network. Hansen advised high-risk users to stop using the SKS network at once.

GnuPG responded in version 2.2.17 (July 9, 2019). By default it now ignores all key signatures received from keyservers and keeps only the owner's self-signatures. The release notes call this a mitigation for "a DoS due to keys flooded with faked key-signatures". This is why third-party signatures, the basis of the old web of trust, no longer travel through keyservers by default.

keys.openpgp.org (2019)

keys.openpgp.org launched on June 12, 2019, a couple of weeks before the attack, as an alternative to the SKS pool. It was a community project of Enigmail, OpenKeychain and Sequoia PGP. Its server software, Hagrid, is written in Rust on top of Sequoia PGP and released under the AGPLv3. It works differently from SKS:

It publishes an email address only after the owner clicks a confirmation link sent to that address.
Keys whose addresses are not confirmed are served without those identities, so they can be found by fingerprint but not by email address.
Owners can remove their published addresses.

Three months after launch it had over 70,000 verified addresses, and 100,000 by November 2019. Clients such as GPG Suite, Enigmail and OpenKeychain made it their default. In April 2023 it adopted a written constitution and a board of five members elected by OpenPGP contributors. The keys.openpgp.org guide shows how to use it.

The end of the SKS pool (2021)

By mid-2021 the sks-keyservers.net site described the service as deprecated: no longer maintained, with no new HKPS certificates being issued. On June 21, 2021 it posted an update: "Due to even more GDPR takedown requests, the DNS records for the pool will no longer be provided at all." Pool names such as pool.sks-keyservers.net, which many guides and configuration files used, stopped resolving.

GnuPG 2.2.29 (July 4, 2021) and 2.3.2 (August 24, 2021) changed the built-in default keyserver to keyserver.ubuntu.com. The release notes describe this as "a temporary change due to the shutdown of the SKS keyserver pools." GnuPG 2.5.3 (January 9, 2025) removed the built-in default altogether: "There is no more default for a keyserver." As of November 2026 the current stable series is 2.5 (2.5.24, released September 23, 2026), and the 2.4 branch reached end of life on June 30, 2026. With a current GnuPG you therefore name a keyserver yourself, in dirmngr.conf or with --keyserver.

Hockeypuck and today's servers

Hockeypuck is an OpenPGP keyserver written in Go by Casey Marshall and contributors. Its copyright notices date from 2012. It stores keys in PostgreSQL and speaks the SKS reconciliation protocol, so Hockeypuck servers can still sync with each other in a pool. As of November 2026 the latest release is 2.4.1. keyserver.ubuntu.com runs Hockeypuck. Its statistics page reported about 7.96 million keys on November 4, 2026. Like the old SKS servers, and unlike keys.openpgp.org, it does not confirm email addresses. A search can return keys that someone else uploaded under another person's name, so always check the fingerprint. The run a keyserver page covers setting one up.

The HKP protocol is still being written down. Andrew Gallagher's individual draft, draft-gallagher-openpgp-hkp, was taken up by the IETF OpenPGP working group. As of November 2026 the current text is draft-ietf-openpgp-hkp-01 (June 5, 2026), by Daphne Shaw, Andrew Gallagher (editor) and Daniel Huigens. It is still a draft, not an RFC.

Web Key Directory

A different approach avoids central keyservers altogether. With a Web Key Directory (WKD), each mail domain publishes its users' keys on its own HTTPS server. GnuPG added experimental WKD lookups in version 2.1.12 (May 4, 2016), and according to the GnuPG wiki they have been on by default since 2.1.23. Kernel.org, Debian, the Tor Project and many mail providers publish keys this way. See Web Key Directory.

Key dates

Date	Event
June 13, 1994	Last update of Michael Graff's list of email keyservers
December 15, 1994	pgp.net registered
1995	keys.pgp.net announced
February 28, 1996	keys.pgp.net charter
September 2002	Yaron Minsky explains SKS reconciliation on the keyserver list
March 2003	First HKP Internet-Draft (David Shaw)
October 12, 2003	SKS moves to Savannah
May 4, 2016	GnuPG 2.1.12 adds WKD lookups
June 12, 2019	keys.openpgp.org launches
Late June 2019	Certificate flooding attack on SKS
July 9, 2019	GnuPG 2.2.17 ignores keyserver signatures by default
June 21, 2021	SKS pool DNS records withdrawn
July 4, 2021	GnuPG 2.2.29 defaults to keyserver.ubuntu.com
April 28, 2023	keys.openpgp.org adopts a constitution and elected board
January 9, 2025	GnuPG 2.5.3 drops the default keyserver