Hence "You should download multiple developers' public keys from at least two independent sources each and ensure they match. Ideally, you should verify key fingerprints in person with the developer(s) to the best of your ability."😉

Catch me at a Bitcoin conference sometime - I carry around business cards with my PGP key fingerprint.

In the past, Core devs have had key signing meetings, but I had to make a new key after the last one