I setup a server to mimic a key server and return a plain text file from
pks/lookup. I then added a random public key to the lookup file. I then
requested an different key from the command line using "gpg --keyserver
hkp://localhost --recv-keys 0xFBB75451". To my surprise, the fake key imported
without error. Ideally, GnuPG should check the returned key's fingerprint
against the fingerprint being requested. If the fingerprints do not match, the
import should fail.

Since key server communication is not encrypted, an adversary can easily reply
with a fake key and intercept subsequent encrypted communication.