code: def _get_key_by_keyid(keyid):
      
      # options=mr - machine-readable output (disables html wrappers)
      keyserver_url = ('https://keyserver.ubuntu.com'
                       '/pks/lookup?op=get&options=mr&exact=on&search=0x{}')
      curl_cmd = ['curl', keyserver_url.format(keyid)]
      # use proxy server settings in order to retrieve the key
      return subprocess.check_output(curl_cmd,
                                     env=env_proxy_settings(['https']))
docs: Get a key via HTTPS from the Ubuntu keyserver.
      Different key ID formats are supported by SKS keyservers (the longer ones
      are more secure, see "dead beef attack" and https://evil32.com/). Since
      HTTPS is used, if SSLBump-like HTTPS proxies are in place, they will
      impersonate keyserver.ubuntu.com and generate a certificate with
      keyserver.ubuntu.com in the CN field or in SubjAltName fields of a
      certificate. If such proxy behavior is expected it is necessary to add the
      CA certificate chain containing the intermediate CA of the SSLBump proxy to
      every machine that this code runs on via ca-certs cloud-init directive (via
      cloudinit-userdata model-config) or via other means (such as through a
      custom charm option). Also note that DNS resolution for the hostname in a
      URL is done at a proxy server - not at the client side.
  
      8-digit (32 bit) key ID
      https://keyserver.ubuntu.com/pks/lookup?search=0x4652B4E6
      16-digit (64 bit) key ID
      https://keyserver.ubuntu.com/pks/lookup?search=0x6E85A86E4652B4E6
      40-digit key ID:
      https://keyserver.ubuntu.com/pks/lookup?search=0x35F77D63B5CEC106C577ED856E85A86E4652B4E6
  
      :param keyid: An 8, 16 or 40 hex digit keyid to find a key for
      :type keyid: (bytes, str)
      :returns: A key material for the specified GPG key id
      :rtype: (str, bytes)
      :raises: subprocess.CalledProcessError