Filtering Third-Party Certifications
I think OpenPGP CA should publish third-party certifications. In fact, that's kind of the point. Still, if OpenPGP CA fetches updates and integrates them into the WKD, then it is possible for a malicious third party to flood the certificates. To avoid this, openpgpkey control does the following:
For the bundles, we use "clean" exports, which allows for a signature from another key, if that key is known to the keyring, and we arrange to ensure that the keyring which generates those exports only includes the keys in this repo and specified in the bundles.
OpenPGP CA could do something similar. For instance, if a key can be authenticated, then it is also okay to include a certifications made by that key. OpenPGP CA could use just the openpgp ca key as a root or all keys in the organization.