Comment by KirinDave

That's fine, but gpg signatures would do nothing to prevent this and widy scaled webs of trust don't exist.