you don't need a PGP key, and in fact you can easily filter the traffic to your security@ inbox with a simple rule - is it encrypted with the PGP key? you can delete it, it's probably bullshit.

experienced reporters will recognize that the flaw they are reporting is already publicly visible and the thing that is the most important is getting attention and fixing the issue, secrecy won't help. you will get garbage reported to you encrypted, stuff like "I can see that your website uses PHP because there are URLS that end in .php".