Public key on keyserver.ubuntu.com not complete

Hi, thank you so much for your work. I was installing TeXLive 2026 on my
Ubuntu WSL, and when I was validating the downloaded script I noticed
that pulling the public key from keyserver.ubuntu.com did not pull the
real key used to sign the sha512sum files. Here's an extract of my bash
session:

$ sha512sum --check install-tl-unx.tar.gz.sha512
install-tl-unx.tar.gz: OK

$ MYTEMP=3D`mktemp -d`

$ TLKEYID=3D0D5E5D9106BAB6BC

$ gpg --verify install-tl-unx.tar.gz.sha512.asc
gpg: assuming signed data in 'install-tl-unx.tar.gz.sha512'
gpg: Signature made Mon Jun  1 01:50:51 2026 CEST
gpg:                using RSA key D8F2F86057A857E42A88106A4CE1877E19438C70
gpg: Can't check signature: No public key

$ gpg --recv-key --keyserver hkps://keyserver.ubuntu.com/ $TLKEYID
gpg: key 0D5E5D9106BAB6BC: public key "TeX Live Distribution
<[email protected]>" imported
gpg: Total number processed: 1
gpg:               imported: 1

$ gpg --homedir "$MYTEMP" --verify install-tl-unx.tar.gz.sha512.asc
gpg: keybox '/tmp/tmp.WEuBD0r2KL/pubring.kbx' created
gpg: assuming signed data in 'install-tl-unx.tar.gz.sha512'
gpg: Signature made Mon Jun  1 01:50:51 2026 CEST
gpg:                using RSA key D8F2F86057A857E42A88106A4CE1877E19438C70
gpg: Can't check signature: No public key

$ TLKEYID=3DD8F2F86057A857E42A88106A4CE1877E19438C70

$ gpg --recv-key --keyserver hkps://keyserver.ubuntu.com/ $TLKEYID
gpg: key 0D5E5D9106BAB6BC: "TeX Live Distribution <[email protected]>"
not changed
gpg: Total number processed: 1
gpg:              unchanged: 1

$ gpg --homedir "$MYTEMP" --verify install-tl-unx.tar.gz.sha512.asc
gpg: assuming signed data in 'install-tl-unx.tar.gz.sha512'
gpg: Signature made Mon Jun  1 01:50:51 2026 CEST
gpg:                using RSA key D8F2F86057A857E42A88106A4CE1877E19438C70
gpg: Can't check signature: No public key

$ gpg --auto-key-locate=3Dwkd --locate-keys "[email protected]"
pub   rsa2048 2016-03-19 [SC]
      C78B82D8C79512F79CC0D7C80D5E5D9106BAB6BC
uid           [ unknown] TeX Live Distribution <[email protected]>
sub   rsa2048 2016-03-19 [S] [expires: 2027-07-13]
sub   rsa2048 2016-03-19 [E]

$ gpg --homedir "$MYTEMP" --verify install-tl-unx.tar.gz.sha512.asc
gpg: assuming signed data in 'install-tl-unx.tar.gz.sha512'
gpg: Signature made Mon Jun  1 01:50:51 2026 CEST
gpg:                using RSA key D8F2F86057A857E42A88106A4CE1877E19438C70
gpg: Can't check signature: No public key

$ wget https://tug.org/texlive/files/texlive.asc
--2026-06-01 12:26:01--  https://tug.org/texlive/files/texlive.asc
Resolving tug.org (tug.org)... 46.4.94.215
Connecting to tug.org (tug.org)|46.4.94.215|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 5231 (5.1K) [application/pgp-signature]
Saving to: =E2=80=98texlive.asc=E2=80=99

texlive.asc
100%[=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D>]
  5.11K  --.-KB/s    in 0s

2026-06-01 12:26:02 (529 MB/s) - =E2=80=98texlive.asc=E2=80=99 saved [5231/=
5231]

$ gpg --homedir "$MYTEMP" --import texlive.asc
gpg: key 0D5E5D9106BAB6BC: 2 signatures not checked due to missing keys
gpg: /tmp/tmp.WEuBD0r2KL/trustdb.gpg: trustdb created
gpg: key 0D5E5D9106BAB6BC: public key "TeX Live Distribution
<[email protected]>" imported
gpg: Total number processed: 1
gpg:               imported: 1
gpg: no ultimately trusted keys found

$ gpg --homedir "$MYTEMP" --verify install-tl-unx.tar.gz.sha512.asc
gpg: assuming signed data in 'install-tl-unx.tar.gz.sha512'
gpg: Signature made Mon Jun  1 01:50:51 2026 CEST
Gpg:                using RSA key D8F2F86057A857E42A88106A4CE1877E19438C70
gpg: Good signature from "TeX Live Distribution <[email protected]>" [unknow=
n]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owne=
r.
Primary key fingerprint: C78B 82D8 C795 12F7 9CC0  D7C8 0D5E 5D91 06BA B6BC
     Subkey fingerprint: D8F2 F860 57A8 57E4 2A88  106A 4CE1 877E 1943 8C70



As you see, the file appears to be signed with the subkey
4CE1877E19438C70, but both on the keyserver and the WKD I could only
find the primary key 0D5E5D9106BAB6BC. Downloading from tug.org solved
the issue. I haven't checked keys.openpgp.org becuase IIRC it is not
maintained right now (?). Hope this helps anyway!

Best regards,

Alessandro Bertulli