[kwk1]

If you're using a Debian derivative these keys should be in packages distributed with your distro with trust coming from that

[SAI_Peregrinus]

Since the distro's site was compromised you also have to check that any keys it distributes haven't changed. And that the compromise wasn't done by a legitimate maintainer.

[kwk1]

The packages in question don't come from the distro's homepage.