Updating OpenPGP keyserver adding and removing identities

Question

When adding new identities to my OpenPGP key, I can upload the public key to a keyserver for others to update their copy.

Now, when I remove an identity, will the keyserver update to the new version of my public key, or will it keep the older copy since the new version contains less identities?

If it does update the key, like I asked for, will someone else be able to overwrite my new copy of the public key with their old one, if they would upload it?

Answer 1

An OpenPGP key is not a single object, but consists of a whole stream of OpenPGP packets. For example, a public key message consists of (among others) the primary public key packet, subkey packets, user ID packets and different kinds of signatures, some providing certifications by other OpenPGP users, others binding user IDs and subkeys. Key servers will always merge those packets, never delete anything.

If it does update the key, like I asked for, will someone else be able to overwrite my new copy of the public key with their old one, if they would upload it?

If you add another user ID, another packet will be added (and merged when sent to the key servers). This also includes that other users uploading "old" versions of your key will not remove your newly added user IDs -- they upload an "incomplete" copy, which will get merged (and probably not change anything at all).

Now, when I remove an identity, will the keyserver update to the new version of my public key, or will it keep the older copy since the new version contains less identities?

On the other hand, this also means you cannot delete old user IDs, as this does not fit the "merge" mode of operation the key servers have. Instead, you revoke old user IDs (and all other kinds of OpenPGP entities), which results in a special revocation signature added as another OpenPGP packet, and merged into your public key.

Answer 2

You cannot "overwrite" or otherwise remove data from a PGP keyserver – you can only revoke it (using GnuPG's revuid), and then upload the "revocation signature" to the keyserver.

However, modern keyservers only accept identities signed by the main key – that's the "[self-signature]" entry that you can see in a signature list. While someone could easily craft a fake user ID packet, they cannot fake a self-signature.