> Do I trust 8,000 keys? Which ones are OK? You can at least trust more 8000 developers whose keys are centrally signed, than 8000 packages thrown into signing

> Do I trust 8,000 keys? Which ones are OK? You can at least trust more 8000 developers whose keys are centrally signed, than 8000 packages thrown into signing CI tooling by who knows.