I think it's shitty that someone is attacking the GPG keyring. That's an asshole move. But before this, I didn't realize that it had known exploits dating back many years, did you? Security through obscurity isn't a thing, so who know who else has been attacking it all along but less publicly.