I think the point was the binaries would be distributed around different mirrors that might not be under the control of the author - so long as you got the key from the author the actual binary (which is a much larger filesize than the key) could have less secured mirrors.