CalyxOS is an Android distribution that
claims a focus on privacy and security. So when an
announcement from the project begins by saying "we want to assure
you that we have no reason to believe the security of CalyxOS and its
signing keys have been compromised", chances are that good things are
not happening.

In this case, it would appear that...