You seem to have your systems quite in order sir
Do you mind while we stray somewhat off topic if I ask, how you authenticate your recipients public key?
I'm supposed to get their GPG fingerprint from a more secure channel, such as voice or telephone (including SMS or text messages). But these days you can do VOIP, and some chats, some video conferencing, skype, yahoo with webcam, etc. The best method, of course, is in person.
Also depends on how much you should trust the other party, if it's just casual conversation or he's trying to buy something from me, I don't even bother, I just accept his public key and check later (from somewhere else, another physical internet connection from another physical location) if I got the same public key. I try to check if it's from a keyserver or his own private web page or something.
Would be very hard for some bad guy to compromise all of those unless the poor guy has already been a national security level target for some time and he's been replaced by a clone or something.
I can probably accept the public keys of most of the bitcoin devs, for example, and use those to communicate with them and/or verify the latest bitcoin-qt releases.
