This is a really interesting insight into the way someone found access to a system but could someone explain to me why he needed PGP keys from heroku? I'm sure there is some good reason but if someone could tell me that would be great.
Although, if you're going to trust the pgp key you get sent when you mail someone asking for one, you don't have any more assurance that you're encrypting it to the person you intended, and you _almost_ may as well have sent it in cleartext in the initial email...
Get your pgp fingerprints in some out-of-band method of communication. (When was the last time anybody even heard of a key signing party? I attended on at the Perl Conference in '98 or '99 - don't think I've been aware of one happening in any of my circles since)
Now the paranoid in me is wondering - if there's an attacker deeply entrenched enough to be reading their plain-text email, either on the wire between them and you or with sufficient root privs on their infrastructure, they could probably have arranged their own pgp key to appear there for you as well. If I were trying to ensure I was doing my utmost best diligence, I'd have tried to include a completely non-internet backchannel - perhaps a call phone number for Heroku sourced from a dead-tree phone book (if such a thing exists anymore?) and get someone to read out the key fingerprint.
I'd like to hope the whole "web of trust" idea could solve this problem. If I've got a large enough set of people I've been sending signed or encrypted email too using a particular key, that history means I've got a pretty reliable idea that the key is "real". With a bit of luck, if enough of my set of people has their own group of historically-verified keys, I might have a good enough chance of finding someone I know and trust who'll vouch for a key fingerprint of someone I need to securely communicate with.
(I wonder if pgp signing registration email or payment receipts might help here? Or perhaps including key fingerprints? It'd be nice to be able to mail a user/customer saying "here's our PGP key, and you can check it against the key fingerprint we sent you when you signed up" or maybe " … that we print on every invoice" ?)
S/MIME email is another end-to-end encryption scheme, like PGP, but it isn't as popular among a technical crowd as PGP is.
In other words, that they have passed the key along to employees and other trusted (ie. large web-of-trust) tiers - which in turn have put their keys to use to verify that this key belongs to the security team of Heroku.
To verify the verifications, you could contact one of the trusted parties and ask them how they are sure that the particular key is correct - if in doubt.
:)