[perihelions]

Can you associate a PGP pubkey to an email address, in Facebook's workflow, without verifying access to that address?

[repelsteeltje]

Not sure, I don't use Facebook. I suppose that if you have access to the account and are able to associate PGP, you might as well change the recovery email address too if hacker doesn't already have a way to read it.