The name `junio-gpg-key` is a lightweight tag in the git git repo. It's not that hard to update, though it requires both force push and force pull (to an existi

The name `junio-gpg-key` is a lightweight tag in the git git repo. It's not that hard to update, though it requires both force push and force pull (to an existing clone, new ones get the latest value no matter what). It is something of a security risk because there is no audit log for force pushes and anyone with force push access to that repo could update that tag at any time. Also, because it is a lightweight tag, it is not itself signed so could potentially be man-in-the-middled. That said, yes it is a public key and public keys are meant to be public. In many threat models this isn't a "huge deal". The issue, as often the case, with public keys is that you still need a chain of trust somehow defining if you should trust that public key. A public key that you get from the repo itself that anyone could force push an update to is possibly not one you should trust without additional verification channels involved.