They meant that they wanted to do a test to see if they would get any gpg-encrypted emails from people who saw the hat in real life; the “experiment” doesn’t work if you allow internet strangers to email you too, as then you don’t know where a person may have gotten the email address/key from
Udrub udrub tel aviv