Maintaining the kernel's web of trust

Sure, but what is your definite source of information for your local copy? ...kernel.org
At some point in time Tx you get the initial clone, how do you know that T_attack is not < Tx ?
-> You gotta talk to someone else, not kernel.org

There's new data coming in from kernel.org and you have a new signature from a new contributor. How do you establish that you trust them? Your local copy doesn't help.
-> You gotta talk to someone else, not kernel.org

There is no trustworthy information authority, IMO, aside from, say Konstantin's local git repo copy (if he is the person to extend the git repo with new signatures). It's kind of a circular argument IMO once you involve kernel.org.