No, Proton didn't assume WKD was activated, and WKD doesn't have much to do with what's going on. What happened is:
- The user, or their software, uploaded a public key to keys.openpgp.org
- Proton looked up their email address on keys.openpgp.org, and sent them an encrypted email
- They didn't have the private key anymore, and couldn't read the email
The fix is to remove the key from keys.openpgp.org, or remove the email address from the key, or remove the encryption subkey.
Alternatively, setting up WKD would actually work as well, since then Proton uses that instead. I.e. if there's no key on WKD, we don't send encrypted emails.
Why does proton look up keys.openpgp.org? Is keys.openpgp.org assumed to be The One Directory for everyone ? Who said so ?
There is no reason to consider it as the centre of the world if you deon't use it. That's exactly what wkd is about: specifically saying that there is a key to talk to you, and where it is.
If I publish a key in my Myspace profile that doesn't mean it's valid. The author never signalled any key to be usable, the key being on that specific directory means nothing.
It's not the first time you take liberties with protocols and specs under the premise of "simplification", and again ano again things break because you don't respect anything. How can you be taken as a peer of value if you keep screwing up and accusing users for not holding it right ?
keys.openpgp.org is the semi-canonical key server for OpenPGP. Certainly there are other key servers, but it makes more sense for us to look up keys on a keyserver hosted under openpgp.org than one hosted by Ubuntu or any other single entity. KOO is a community-led and -governed project. It now even has elections and a board (which we joined): https://keys.openpgp.org/about/news#2023-04-28-governance
WKD is great, but can't be used by people with email addresses under domains that don't support it. So KOO fills that gap.
Yes, KOO is a good intermediary, but it still matters: there are no agreed-upon mechanism saying it should be used in all cases. You took this liberty. Why not even ask the receivers, aka those who know, if they're ok using that key ?
We can't easily ask them that. KOO could ask, though, since that's what the user's interacting with when they're uploading the key. And, I do agree that the signalling could be improved, there, so I'll discuss it with them.
Don't upload your key to a public keyserver with an email address you have to verify you don't want to receive encrypted things with. That is the opt-in!
Usually the problem is the exact opposite, it's really annoying to find someone's public key even if they have given you the key ID or mentioned they can receive such mail.
That a key exist on a random keyserver means nothing. There is a spec that explicitely says "if you want to use my key here it is" and Proton doesn't respect it. what does it mean that you found the key on some third-party domain ? There are 0 safeguards, I don't know what they're going to do with it, there is no obligation from any side. A key in keys.openpgp.org means nothing.
Yes, but that's not a protocol. That's uploading a key to a server. The protocol is WKD and Proton doesn't respect it.
Me opening an account on GMail doesn't mean I want people to contact me on GMail. If our protocol, ie you asking me what is my email and I don't give you my email then I don't want you to contact via my GMail account.
- Proton uses WKD for keys outside its own domain
- OP didn't activate WKD for their own key (there is no CNAME)
- But Proton still assumed that it was activated, that their key was on keys.openpgp.org and that it was valid
It is hard for me to see how this is not a fault with Proton and Proton only. If the user didn't opt-in, don't opt-in for them !