agree, and some of them are quite hard to search, e.g. Mullvad VPN, I couldn't find it in other places besides their site, madness.

updated
github ☑️ https://github.com/mullvad/mullvadvpn-app/releases/tag/2023.6

Best way is to spread your key fingerprint around imo.

If you only use one site as the source of trust, it's a single point of failure. Even if it's Github.

_I have to do that myself, still figuring things out around PGP keys_

now I finally understand what you mean here, why not just put each dev's key in GitHub 😨