Funny how this Cybersecurity reporter publish his PGP key using unsecured protocol. http://www.ericjgeller.com/pgp_ejg.txt
(A possible workaround is to check via multiple connections, check Google's cache, etc)
I think his actual point was to try and discredit the messenger.
Also, PGP keys may also be used to sign software or other public messages (not a typical use-case for journalists, though)
Also, you don't sign software or whatever with a public key, so I'm not 100% sure you understand how this works.
They could far more easily gain access to his server through a variety of means and upload a different copy of his key than try and do a MITM or whatever. It's not like he's going to notice if the key changes.
What you're proposing is that an intelligence service is going to MITM you and gain access to the journalist's computer or email server to read the messages you may send him? Why? The messages are unencrypted when read on his system and when typed on yours, so there are far easier ways to get at their contents.
You write him something -> he doesn't read.
You write him -> emails is intercepted -> he doesn't read it but who intercepted the email reads.
So his computer is never compromised. But his email server (some provider) is.
Assuming you trust Keybase (or if not fully trust at least consider it part of a more general trust network) then the key can be verified against that. That it's hosted over HTTP or any other protocol is irrelevant if it's also attached to some trust network. You can obtain it, check the fingerprint and/or value against his Keybase information and determine then whether or not you trust the key.