As I understood it, they'd have to MITM both Keybase.io and every single one of the websites where a given user verifies their identity (and then there's certif

As I understood it, they'd have to MITM both Keybase.io and every single one of the websites where a given user verifies their identity (and then there's certificate pinning which I would assume the Keybase client would know about and respect, but then again if your download of the client was compromised ..). Not impossible, but there's a lot of logistics to get right. Also, they'd have to do it as you sign up. Once your profile is active and you've followed people and their signatures are cached on your local computer, the root CAs are no longer the single point of failure and MITM'ing becomes impractical. That said, if a state, especially the one you're in, targets you personally, you're going to have a bad time.