True, but the site has to be compromised at the moment you are downloading the keys (not anytime later!), and then all your further installations have to me MITM-ed or you would take notice. Not so trivial for attacker anymore.<p>Ideally, the keys should be distributed in safe fashion too, so this whole question should be moot.