If I want to verify a the signatures on a project whose packages I download & verify frequently, would it be reasonable to for me to sign that project's signing key?
Currently, I verify the signature using GPG, I then have to manually check the signature fingerprint against the fingerprint published online. Is this a correct use case for signing a key? I have no friends in the web of trust through which I can trust these keys.
Of course, I've never met anyone in person to verify the key, but I've verified several signatures of the same key over a period of a couple of weeks. I think I can be reasonably certain that the signing key is theirs.