With HTTPS, I need to trust every government in the world to not interfere with CAs. With GPG, I only need to trust Debian to give me Debian. Is there really

With HTTPS, I need to trust every government in the world to not interfere with CAs. With GPG, I only need to trust Debian to give me Debian. Is there really a question about security here?