Also, the age of the tweet or gist would be a red flag. If the signed gist is 2 years old and hasn't even modified since, you can pretty safely assume that if t

Also, the age of the tweet or gist would be a red flag. If the signed gist is 2 years old and hasn't even modified since, you can pretty safely assume that if the keybase public key matches the signed message in the gist, nothing nefarious has happened recently.