Just a note: I think I was hoping (but didn't confirm) that I was downloading the key from GNU and the file from a mirror. So I thought I had the minor protection that I was at least safe from somebody who could only alter the mirror. But I agree with the criticism: not being clear what you are claiming to actually check in a crypto-situation can confuse others and cause harm. Sorry about that.