&gt; Even in the case where you just obliviously add the repository&#x27;s PGP key, you are protected against the file server being compromised.<p>Unless you got the PGP key from the same file server, which is typical.