https://launchpad.net/apparmor/+download provides GPG signatures for the releases of */*apparmor* source packages, it would be nice if the ebuilds checked them.