Sorry, I think I misread the comment when I made my initial reply.

Edit:

If you mean the key provided for the demonstration, you could ensure that you get the correct one by checking the signature (it's signed by my personal key) or by doing the initial download through i2p or tor. Once it's added to your keyring, you maintain that same key for all the subsequent checks. Or, if you don't want to do either, you could consider it as a Trust-on-first-use system.

The important point is that it's a layered system, rather than a single point of trust, and that once you trust it, it cannot be compromised.