title: Verifying a signature with an explicitly given public key
body: <p>Suppose you want to distribute a file <code>foo</code> along with its detached signature <code>foo.sig</code> and your public key <code>public.key</code>.</p>
  
  <p>Suppose further you want to make signature verification as easy as possible, i.e. in the minimum number of steps: just one command. Ideally something like</p>
  
  <pre><code>gpg2 [magic option combo here involving foo, foo.sig, public.key]
  </code></pre>
  
  <p>I've read the gpg2 man page up and down a few times, but it seems the receiver needs to first <em>import</em> the public key to his key ring.</p>
  
  <p>Is there a way to avoid importing the public key and specify it explicitly? I would like to avoid the receiver being spammed with a newly created <code>$HOME/.gnupg</code> directory and its contents.</p>
  
  <p>Or am I trying something stupid from a security point of view?</p>