The point of GPG is to download the public key of the signer (in this case, the package maintainer).  Then, you check it&#x27;s bona fide, either by verifying that you have a trusted connection through your web of trust, or (more likely) by verifying the key id is mentioned in other trustworthy places (like legitimate Ansible and Bash scripts, etc.).<p>After that, you have a trusted signature, and it doesn&#x27;t matter if it the signature page is defaced.<p>If you&#x27;re downloading the signature each time you&#x27;re downloading a new version of a package or iso, and its SHAs, you&#x27;re using GPG incorrectly.<p>I&#x27;ve had many signatures for package signers in my keyring for 5+ years.  If and when they replace the key, they let the community know and we update our keyrings.<p>Yes, if you don&#x27;t want to do that, fine, but for those of us who are careful users of GPG, it&#x27;s a huge barrier against malware in packages and distros.