Cryptographic weakness on Debian systems

Even if those keys were compromised, that's OK. If the announcement is 
legitimate, then the fact that the keys are compromised is not 
problematic, because it was actually signed with the secret key. If it's 
*not* legitimate, and has been signed by a forger, then... why on earth 
would they tell us that the keys were weak, destroying their own strong 
point? (And if the message is forged and the sender is lying, being a 
nasty forger and all, well, er, a forger telling us that the keys are weak 
when they're actually *strong* seems really rather implausible.)

I'd worry much more about an announcement coming out of the blue saying 
`hey, our keys are OK, keep using them!' because that *is* an announcement 
that an attacker who'd nicked the keys might want to give out (if he 
wanted to make people like me suspicious, anyway).