I frequently use GPG to verify downloads. By doing that I implicitly put trust in a key provided by the author. At least I trust the key enough to run software verified using the given key on my computer. Some examples might be a GNU/Linux distribution maintainer's key published on its homepage (available over HTTPS) or a program author referencing his Keybase.io profile that is intended to be used to obtain a GPG key for singed packages verification.
To mark such a keys as trusted explicitly instead of just importing them into my keyring it looks reasonable to sign them with my key. Persona certification level (0x11) seems to be appropriate in this case. Extending that it might be useful to make my signatures publicly available so a friend of mine downloading a package from the same author could benefit from having the key double-checked as safe to use.
Are there any substantial drawbacks to this approach except privacy concerns?