In case you missed it, grafana leaked their package signing key AND the passphrase. This has not been loud enough: https://grafana.com/blog/2023/08/24/grafana-security-update-gpg-signing-key-rotation/