Most people happily install whatever GPG key to apt the website tells them too. If they can compromise the installer probably they can compromise the page too.

Most people happily install whatever GPG key to apt the website tells them too. If they can compromise the installer probably they can compromise the page too. Secondary fun fact when you add a key to GPG it's valid for any package from any repository. That repository could happily replace libc, or perhaps more strangely a key used to sign some popular repository could be uploaded to say the main Debian archive and anyone with that key added would happily install it with no errors. Plenty of side cases in reality