> a good answer to key management
The problem with key management is that everyone tries to solve the management problem with a single solution. A single method will always have to make choices about the threat model, which can only truly be known by the user. A single user can even have more than one threat model, depending on what they are doing.
What we need instead is some sort of configurable layer that allows the user to specify how keys should be managed by selecting what they want to trust.
They could use a default delegation to a public trust root (the PKI model, no configuration needed) for most things. Receiving a call from the bank could instead be authenticated with the key they got when they physically walked into the local branch. Chat with their immediate friends who can exchange keys on their phone when they meet up in person is easy, and a web of trust can extend that to a friend-of-a-friend. People understand the concept of vouching for someone, and over time more than one method can be used to cross-check.
Key management shouldn't be "PKI vs web-of-trust vs out-of-band-keybase-style vs manual-key-exchange vs ..."; it should be "all of the above, with the chain-of-trust exposed". Anything else is making assumptions about what the user's current needs.