[woodruffw]

> the key verification for those artifacts does work and has worked forever.

Go try to verify some of the PGP signatures on CPython releases that are older than 2.7. You might be surprised.