Librewolf update key differs from repo key?

[fsflover]

Seems relevant:

There is no way to validate Qubes Master Signing Key

From a recent Hacker News discussion: If Qubes ISP is malicious or compromised they can intercept http connections towards Qubes’ servers. This allows them to trivially obtain a SSL cert for keys.qubes-os.org, etc. Armed with a valid SSL cert, they MITM traffic. When a target downloads qubes they give them a tampered version, when a target downloads the master key, they give them a lookalike key. The user can happily verify the tampered qubes with the lookalike key. PGP proves nothing if yo…