Comment by murphyslaw

Just an assumption here, but the project appears to be about the methodology to verify the install. Who holds the keys is an entirely different matter.