The catch is that signing a key does not usually convey "trust", just "identity". In Debian, trust is assigned at the end of a successful application process to becoming a Debian Maintainer or Developer, and this trust is conveyed for a particular identity with presence in the official Debian keyring. So in Debian, trust is centralized.

However, it doesn't have to be exactly like this. I can imagine a decentralized system built on the same tooling. For example: you could require three certifications from existing members in the set, bootstrapped from Guido, for inclusion in the trusted keychain. (You might additionally limit the maximum degrees of separation from Guido to assist with auditability).