The SKS keyservers are getting increasingly unreliable and https://keys.openpgp.org/ doesn't track signatures to begin with, so we need a more well-formed mechanism to

• add the keys of new SREs to pwstore
• update keys for existing SREs (lost laptop, expired keys etc) for pwstore

One option would be to simply let people add the public PGP key to the pwstore repo itself, along with a small wrapper to import it. In addition pwstore would probably need to be patched to read from the local keyring when doing "pws update-keyring"

Then:

• anyone who wants to be reachable via encrypted email, can upload their key to https://keys.openpgp.org/.
• anyone with the need for access to pwstore adds their key to the repo