I was recently introduced to a privacy issue when refreshing your
OpenPGP keys using GnuPG. When refreshing your public key ring using a
public key server GnuPG will generally use the OpenPGP HTTP Key Protocol
(HKP) to synchronize keys. The problem is that when you do refresh your
keys using HKP everyone that you maintain in your public key ring is
sent across the Internet unencrypted. This can allow anyone monitoring
your network traffic to receive a complete list of contacts in which you
may hope to use OpenPGP.
The fix is quite simple: in your gpg.conf file make sure that your
keyserver entries include hkps:// instead of hkp://. This will force
GnuPG to wrap HKP in SSL to keep the key exchange private.
Happy encrypting!