Yes that's quite annoying. Already years ago we talked about a CI step to actually validate the gpg signature key. Still surprises me github doesn't offer that