Its important to note that they're pointing the finger at the MIT PGP keyserver, which has long been notorious for being poor in the security department. This is not even the worst of their crimes; for a long time (perhaps still?) they were ignoring key revocations. Meaning, if your key was stolen and you sent out a message declaring it void, people using pgp.mit.edu would never get the message. >.<
tl;dr don't use pgp.mit.edu .