The pubkey is only secure if the software you downloaded from GitHub, all its dependencies, GitHub itself and all its dependencies, your Browser and all its dep

The pubkey is only secure if the software you downloaded from GitHub, all its dependencies, GitHub itself and all its dependencies, your Browser and all its dependencies and your OS and all its dependencies were neither faulty or malicious at the time you created it. Otherwise the pubkey might have been created in a way that makes it easy to guess for someone in your supply chain.