> I thought of sharing the keys I found but they are a few hundred megabytes The keys are small, the fake sigs are the bloat, they can be removed, leaving a small package again. naclbox has quite some dependencies for win/mac and even unix users, hardly as easy as a gpg or age binary dl/pkg or a single compile from tarball.