Right now we use any key we find. We should probably require some level of trust before using it?

Perhaps we should also validate the key periodically, on the other hand, maybe that is better left to whatever maintains the keys in gpg.