During the passive reconnaissance phase of an external engagement, you must build a list of employee email addresses and associated hostnames for a target company without sending any packets to the client's infrastructure. You want a tool that aggregates results from public search engines, PGP key servers, and certificate sources. Which tool BEST fits this requirement?