Presumably you inspect the thing you're including in your project first, if it seems trustworthy you mark whatever key you have as somewhat trustworthy. Then you inspect differences on version updates of your npm deps. If it still looks ok, you update your trust of the key.

It's the same way you gain trust in something in real life, by watching actual behavior of someone over time. It is just assisted by technology.

Then you can ignore the issue of email completely, because you're not basing your trust on authority of the author, but on his track record as determined by you.

I bet you'll not find many attackers who would maintain some hijacked package for a few months, before launching their attack. Original author would probably notice something fishy too, given enough time.