How about just doing something simple like changing the list address to
"ietf-openpgp" rather than "ietf-open-pgp".
Solves the problem immediately and introduces no new restrictions.
I'd be happy to do this if the WG chair asks. It means him doing a bit of
work with the IETF Secretariat, but that would be trivial. And I agree, it
would eliminate the vast majority of the spam. (The address may eventually
get re-harvested by the spammers, but many IMC-run lists have little or no
spam on them.)
--Paul Hoffman, Director
--Internet Mail Consortium