I more or less trust the maintainers of dpkg and similar can figure it out or have someone point it out to them.
My own shell scripts are maybe more iffy, as I am not myself an expert, but my personal use doesn't see wide distribution.
My own shell scripts are maybe more iffy, as I am not myself an expert, but my personal use doesn't see wide distribution.
Personally, I'm of the opinion that APIs should be as misuse-resistant as possible, and GPG is notoriously intransigent about actually acting as a well-designed API. Additionally, The Update Framework (TUF, https://theupdateframework.github.io/) prevents these issues by design.
Importantly though, it's a big project which in this specific instance meant that someone on earth did end up scrutinizing and publishing exactly the sort of thing you linked.