[malaxii]

Wrong:

Debian installations come with preinstalled keyring with the archive signing keys. Upgrades to that keyring are provided via packages, which are signed with the previous archive key. The same for Fedora and rpm. Public keyservers or web of trust are not involved.

On the internet you can obviously find all sorts of bad guides written by random people.

[mirimir]

That's very good to know. Thanks. I'm far less freaked.

But what about package build chains? Are there ever (or at least commonly) calls to SKS keyservers?