We trust Github, Cloudflare and many big Tech server hosts with access to the PGP keys that sign critical software.

It is important to have verification backups of those keys on multiple channels.

This is an additional one.