Short key IDs in PGP are vulnerable (and so is --refresh-keys)