But Launchpad accounts only get upload rights when their prior work is reviewed by the developer membership board. And the prior work is identified against that

But Launchpad accounts only get upload rights when their prior work is reviewed by the developer membership board. And the prior work is identified against that same Launchpad account. So there is a root of trust: it's the developer membership board. It just happens that the trust system isn't implemented using a PGP web of trust directly.