Link gpg[2] against recent curl to make hkps cert validation work

You really should use a SSL keyserver:
https://help.riseup.net/en/security/message-security/openpgp/best-practices#use-the-sks-keyserver-pool-instead-of-one-specific-server-with-secure-connections

But old curl can't verify the certificates properly:
https://mumble.org.uk/blog/2014/01/03/gpg/

So I fixed it.

And the fact that noone did before probably means most people are leaking all their keyserver lookups. Sigh.