I use a measly four-five packages from the AUR, whose repos I clone with git. In order to then makepkg the repo, I first add the validpgpkeys from the PKGBUILD file by gpg --recv-keys [key] it. This way, makepkg doesn't complain about the lack of valid keys.

However, how do I make sure the git repo wasn't altered during transmit or at rest at the server and that the imported key actually is the valid one? Comparing it to the PKGBUILD link on the AUR repo page also comes with similar risks of lacking authenticity.

Never mind. I found the answer while typing. 😆 Although, you could humor me by answering if I understand it correctly. If the PKGBUILD grabs .asc or .sig files, are those the ones that verify the authenticity of the pgp key?

Signature checking

Note
The signature checking implemented in makepkg does not use pacman's keyring, instead relying on the user's keyring.[1]*

If a signature file in the form of .sig or .asc is part of the PKGBUILD source array, makepkg automatically attempts to verify it. In case the user's keyring does not contain the needed public key for signature verification, makepkg will abort the installation with a message that the PGP key could not be verified.

If a needed public key for a package is missing, the PKGBUILD will most likely contain a validpgpkeys entry with the required key IDs. Import it manually, or find it on a keyserver and import it from there. To temporarily disable signature checking, run makepkg with the --skippgpcheck option.