If there is no trust anchor into the Debian keyring (or any other group, but let's stick to the Debian example here), you have no chance of verifying anything.
Faking Whole Networks/Keyrings
It is easily possible to replicate the full Debian keyring with all it's user IDs and signatures issued, it will look totally legitimate while being completely made up. Pagerank will return the exactly same results for both networks. In the end, this is pretty much was evil32 did on the whole OpenPGP strongly connected component to showcase short key ID collision attacks.
Certificate Authority Root Certificates
This is a general problem of certification systems, you always need a trust anchor. For X.509 (as used for TLS and S/MIME), certificate authorities are used whose certificates are declared as trusted in the browsers and operating systems. For OpenPGP, you'll have to go out and find a trust anchor on your own. For the Debian keyring, going to a Debian user meetup or Free Software conference is a good start, you'll meet a whole bunch of people in the keyring there.
Trust on First Use
For the general case and when the keys have already been used for signing stuff you're already using for quite some time, you could also apply "TOFU" (trust on first use): it is unlikely that somebody was able to fake the Debian keyring (or even only some keys of them) in lots of different sources. Have a look at the Linux installation you have -- there is a keyring inside (pretty much all Linux distributions use GnuPG and OpenPGP to verify software in their packet manager). Grab some copies or computer magazines with Linux distributions inside in different stores. Use different internet connections in different places to fetch the keyring. If you always find some of the keys, very likely they actually belong to the Debian keyring (or similar keyrings). This does not verify individuals, but at least it verifies the membership of that key in the keyring to a given degree.