n the end, the answer is a lawyerly ‘it depends’. If the public key can for example only be connected to a company, it will generally not be considered personal data (except if within the company a system exists where specific public/private keys are allocated to specific people). However, if the public key, with additional information, e.g. in a certificate, can be connected to a natural person, it will be considered personal data.