Maintaining the kernel's web of trust

The idea, AIUI, of this repository, is that you use it to track from keys you trust for reasons outside kernel.org (e.g. because you met Linus and verified his key in person) to keys that you don't trust. While an attacker can replace the keys and the signature chains, they can't forge the roots of your personal web of trust because they do not have access to people's private keys, and without that, they cannot forge a signature from a key you trust due to external comms to a key under their control.