[dgrove]

> perhaps something that can be automated

This is solved using WKD. Thunderbird already supports this with enigmail enabled

[Boulth]

Yes, WKD works well for people in control of their own domain (e.g. kernel.org uses it).

For other people there is also https://autocrypt.org/