Debian does things that way, their developers have to get their key signed by other developers, and a DD who signs someone's key is supposed to check ID. But th

Debian does things that way, their developers have to get their key signed by other developers, and a DD who signs someone's key is supposed to check ID. But there's no similar protection for their upstream.