[SAI_Peregrinus]

Since the distro's site was compromised you also have to check that any keys it distributes haven't changed. And that the compromise wasn't done by a legitimate maintainer.

[kwk1]

The packages in question don't come from the distro's homepage.