The server error is turns out to be relatively simple: urlview was picking up the plain-text version, which wraps the URL in square brackets:

[https://www.facebook.com/…/publickey/verify/?e=1&fp=…&ext=…&...]

The regex which urlview uses includes the final bracket, which causes the error. Once I removed it, I successfully validated the key.

It'd probably be best to put the URL on its own line but if not, RFC 2396 recommends using angle brackets – see “Recommendations for Delimiting URI in Context” in http://www.ietf.org/rfc/rfc2396.txt.