Yeah, at the end of the day it is all about trust. If you trust that X creates tags that don't change, that signature is a trust document. Right, as with many

Yeah, at the end of the day it is all about trust. If you trust that X creates tags that don't change, that signature is a trust document. Right, as with many things in computing often you want "trust, but verify". Trust a good tag by a good author not to change, but also go ahead and store a hash in a lockfile and verify it, just in case.