It would be possible for a hacked website to host a fraudulent key that has signed a fraudulent piece of software, however, one could verify they have the correct key from other places on the internet, and many time these signing keys are signed as valid by somebody else. Once they are confirmed as valid, they will be used for years into the future until the key expires or the certificate is revoked. These keys many times are available on a key server as well, available with a verification signature, or you might already have the key in your keyring ahead of time as previously mentioned. Also, if an attacker did this, it would be an unexpectedly used key, versus every other time they signed software, which would be very noisy and detectable. It would mainly be an attack on everyone who didn't already have the real key.
Since there is a wide array of places the public key can be verified and acquired from, it is much less likely that someone will receive and use a bad public key, and if this attack succeeded, it would be very short lived.