Comment by gmluke

Worth noting that a GPG signature is of limited (though not zero) use if the signing key doesn't have any signatures. In this respect, Debian contrasted favourably with Fedora the last time I looked.