My question was: how do you know that the key that validated the file is the correct key and not a fishy one?