Exactly. It uses the same host as uid's email. So if one have key "John Doe <jd@example.com>" it'd query example.com for reference to the key. It's not a security problem unless one considers their own company's servers untrustworthy.

Technical details from the RFC:

> For example the URI to lookup the key for Joe.Doe@Example.ORG is: https://example.org/.well-known/openpgpkey/ hu/iy9q119eutrkn8s1mk4r39qejnbu3n5q

(local part is SHA-1 encoded)

Source: https://tools.ietf.org/html/draft-koch-openpgp-webkey-servic...