Sorry, since this is not new knowledge to me, I only skimmed the article and missed that bit.

Anyway, I think it's important to emphasize this as so many people just type the verification commands into their computer without thinking what they do and are happy when gpg gives them a thumbs up without understanding ways in which the supply chain may have been compromised.