This is important: since PGP is also used for signing software, and in that world, this kind of compromise can be even more dangerous. The Tor example is great.

This is important: since PGP is also used for signing software, and in that world, this kind of compromise can be even more dangerous. The Tor example is great. Also, check out how many keys are on MIT's PGP keyserver for Gavin Andresen of the bitcoin foundation. Back in 2013 I downloaded bitcoind and spent like an hour just trying to figure out if it was legit or not.