That's partly true, but it also uses a build script that doesn't include the KBFS or GUI bits, which isn't directly under our control. At some point I'll work with the Arch maintainer to figure out what we want the official packages to be, but for now the easier control we have over the AUR package has been convenient. (It's shocking how much easier it was to get our Arch packaging working, compared to deb/rpm.)

Security-wise, you could verify our signature on the .deb package that aur/keybase-bin is downloading. The Linux install instructions describe where to find the sigs.

I'd recommend doing the same thing we do in Arch: repackaging binaries from the .deb packages. We release Linux builds almost daily (if the CI tests are happy), and I worry it would be silly for us to tag the repo at that rate.