Just a general question: why offer a GPG key for download on the same site as the file to be verified? (If you expect users to download the key once and then verify multiple releases with it, why rotate the key every year?)
If I did it right, the code signing GPG key is signed by my personal GPG key, which is signed by the FreeBSD Security Officer GPG key, which is signed by lots and lots of people. So there's a chain of trust.
