Comment 8 for bug 857472

I'm a little worried by the assumption here that adding the key size check is sufficient. It's certainly an improvement, but key ID collisions are clearly possible even without this - they're just more work. The key ID isn't *that* long, and it is still many orders of magnitude easier to construct an attack that involves a key ID collision than to brute-force the key itself. Can somebody explain to me how this approach defends against such an attack?