I am trying to wrap my head around how Public Key Cryptography can really work in a secure manner.
From what I can gather, you go to example.com and download their PGP/GPG Public Key and add it to your keyring. They then send you a text file (or whatnot) signed with their Private Key or Encrypted with your Public Key; and you can verify its authenticity and/or decrypt it.
What if the attacker modified the website in transit to you and signed their own fake key under their name, and you put it in your key ring? Then you go on to validate and decrypt the tampered file assuming it is valid.
I assume I am talking about MITM tampering of the entire web traffic in between, or something similar. I am just unsure how "signing" can protect against that both the key and the data if they were faked in transit.