Alice wishes to publish under a pseudonym a series of texts online. She expects the texts to circulate, and she will not include any way of contacting her. Bob will not know the identity of the pseudonymous author but he will seek to confuse the author's audience by publishing texts that he falsely attributes to the same pseudonymous person. For verification of the authenticity of her writings Alice wishes to use PGP but she does not wish to use a key server. She can only operate online.
Is the following approach sensible?
1) Publish several fairly anodyne initial texts in places that are sufficiently obscure for Bob not to notice for a while, and which are also places of record that date-stamp texts. I'm thinking Usenet here.
2) In each of those texts, include her PGP public key, its 40 hex-digit fingerprint, and a signature made using her PGP private key.
3) Start publishing the texts that Bob will find annoying on open-access websites. In each one, include the said fingerprint, the advice that readers may find her PGP public key in posts that were made to named Usenet groups between two stated dates, and a signature made using her PGP private key.
Bob will now start publishing fake texts. These may state that the author has changed their key and that the new public key is as follows. Or they may state that they have been signed using a key from a pair for which the public key can be found in Usenet articles posted between a different pair of dates.
Alice's idea is that although Bob's actions may be a minor annoyance, she can safely continue publishing texts in the knowledge that the more net-savvy of her readers will be able to verify their authenticity. And as readers start adding to their collection of texts published in Stage 2 who have already saved the public key from Usenet, all they need do to validate authentic texts and invalidate fake ones is to check the signature.
Is she thinking along the right lines? Or is there a gaping hole in the idea which her opponent will be able to drive a tractor through?