[email protected] on Nostr: I was just upgrading and wondered: what if Github comprimise the keys in the guix ...

I was just upgrading and wondered: what if Github comprimise the keys in the guix repo? How do I check the keys? Also, why don't core developers cross signs their keys?