If Elastic Agent are unable to connect with Elastic public URL to retrieve the PGP key, they will fallback to a Fleet Server URL where the public key can be hosted too.

In Fleet Server, we must define a fixed route for hosting the GPG key downloads/signing/key.pub to mirror the public URL and have it read the GPG key in from its configuration using the same secure mechanisms we use to read the TLS private key.
Mandate HTTPS on this endpoint and let Elastic Agent call it whenever needed.

Related Elastic Agent issue - elastic/elastic-agent#3264