Are public key revocations checked/respected?

[cobratbq]

Possibly just a question: are public key revocations respected if present on the keyserver?

Is your feature request related to a problem? Please describe.
Download not only the public key for a certain artifact, but also its revocation signature if present and if so respect it and mark the public key as invalid, and consequently warn about the artifact.

Describe the solution you'd like
pgpverify plug-in to take into account possible public key revocations that are present and known on the keyserver.

Describe alternatives you've considered

• None.
  The alternative of leaving the public key out of the keysmap is insufficient as we would need to know that the public key has been revoked at creation time of the keysmap.

Additional context

[slawekjaranowski]

Currently public key was download once and store in cache directory. When key exist in cache it will not be downloaded once again.

We can introduce feature to evict keys from cache by download date, last usage etc ... for it we should create new issue.

Public key contains all data available from key server also revocation signature.

All signature is checked https://github.com/s4u/pgpverify-maven-plugin/blob/master/src/main/java/org/simplify4u/plugins/utils/PublicKeyUtils.java#L181
but we don't check if signature was made by revoked key.

[slawekjaranowski]

key can be revoked after signature was created, and in this case signature was made by valid key, even now key is revoked.

[slawekjaranowski]

reference #284