@drewdevault @ikke Gentoo has upstream key verification supported, in fact with the keys being packaged so keyservers woes are avoided (and signify/minisign is supported).

Sad part is more that the vast majority of software releases aren't signed at all or when they are, you have to hunt for the key rather than having it maintained at a known and verified location.