> Would the git repository, or a new git repository (guix-keys.git?) be a > bad idea? Best case, we craft something which serves as an GNUPG_HOME > for the keys which then live in the keyring of this thing (compare to > gentoo-keys, debian-keys, etc).
I don't think that is a good idea. Placing it in the same git repository that we are trying to verify means that if an ssh key has been compromised, someone could add a malicious commit and a public key - since this means that developers would be expected to manage their own public keys in this list, it may not even be suspicious. If someone MiM cuirass <-> savannah it would not even show in our view of the repo. The integrity of our source code is given by peer review - we are subscribed to the commits ML so we see other peoples commits. The most important thing is verifying that the substitutes come from signed and verified commits only. Maybe keys need to be stored in the cuirass configuration.
