A good practice is verifying software with a team signing key, to ensure the software hasn't been tampered with.
When I verify a download, I usually stumble upon the following message:
$ gpg --verify keepassxc-2.3.3-src.tar.xz.sig gpg: assuming signed data in 'keepassxc-2.3.3-src.tar.xz' gpg: Signature made Wed May 9 19:40:24 2018 CEST gpg: using RSA key C1E4CBA3AD78D3AFD894F9E0B7A66F03B59076A8 gpg: Good signature from "KeePassXC Release <email@example.com>" [unknown] gpg: WARNING: This key is not certified with a trusted signature! gpg: There is no indication that the signature belongs to the owner. Primary key fingerprint: BF5A 669F 2272 CF43 24C1 FDA8 CFB4 C216 6397 D0D2 Subkey fingerprint: C1E4 CBA3 AD78 D3AF D894 F9E0 B7A6 6F03 B590 76A8
I don't really like this part:
gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner.
Each time I want to install the software on a new device, or each time a new version is released, I need to do the same tedious job: I need to find the official page where I can compare the key fingerprint, and cross-check it with multiple other sources to make sure the official website hasn't been compromised. Not a good UX at all.
One possible solution
One simple solution is to certify the key once and for all, so the check (i.e. the "tedious job", remember?) is done only once. Once I've certified the release key, I can just quick check the gpg output of my freshly downloaded file: no warning --> file OK. Simple.
Even Kleopatra suggests to certify a key by comparing the fingerprint from the official website:
I've read that it is not a good idea to sign a key from someone who you haven't met in real life. But usually, the release keys are not held by a unique person, but by a team, so it's kinda difficult to meet the people in real life.
Is this a good idea to sign a release key (after having cross-checked multiple sources)?