[rlpb]

A PGP key is generally tied to an email address. So autogenerating PGP keys per-email-address surely doesn't tie anything to a real identity any more than an email address already does?