Per the guidelines¹, verify upstream signatures. The fingerprints of the keys contained in `key.asc` were checked against the upstream page (https://dev.yorhel.nl/). ¹ https://docs.fedoraproject.org/en-US/packaging-guidelines/#_source_file_verification
Todd Zullinger