[rthomas6]

The Arch Linux one sort of doesn't count. The AUR is a user-created package repository. Anyone can make a build and add it to the AUR.

[rhencke]

Can you elaborate on what you mean by "doesn't count"?

[selfhoster11]

It's not an official package. The Arch Linux project cannot be held responsible for what non-official packages do.

[rhencke]

I agree with you. I don't think any Chromium distributions are at risk of their keys being revoked - I don't believe Google will take any action here.

But, I also don't see anyone ever talk about this, and I think it's worth people being aware.