Editing Key server (cryptographic) (section)

=== Lack of ownership check ===
The keyserver also had no way to check to see if the key was legitimate (belong to true owner). As consequence anyone can upload a bogus public key to the keyserver, bearing the name of a person who in fact does not own that key, or even worse, use it as vulnerability: the Certificate Spamming Attack.<ref name=sks-attack>{{Cite web|title=SKS Keyserver Network Under Attack|url=https://gist.github.com/rjhansen/67ab921ffb4084c865b3618d6955275f|access-date=2020-09-17|website=Gist|language=en}}</ref><ref name="Gillmor"/>{{rp|at=&sect;2.2}}

Modern keyservers, starting with the PGP Global Directory, now use the e-mail address for confirmation. This keyserver sent an email confirmation request to the putative key owner, asking that person to confirm that the key in question is theirs. If they confirm it, the PGP Global Directory accepts the key.  The confirmation can be renewed periodically, to prevent the accumulation of keyserver plaque. The result is a higher quality collection of public keys, and each key has been vetted by email with the key's apparent owner. But as consequence, another problem arise: because PGP Global Directory allows key account maintenance and verifies only by email, not cryptographically, anybody having access to the email account could for example delete a key and upload a bogus one.

The last Internet Engineering Task Force draft for HKP also defines a distributed key server network, based on DNS [[SRV record]]s: to find the key of ''someone@example.com'', one can ask it by requesting ''example.com''<nowiki/>'s key server.