Developers constantly replace releases on users, bitchat for example recently did that and there are countless others. The Zapstore indexer captures releases from Github once and when the developer edits the release/associated assets the download breaks and users start yelling, so I know well how many times that happens. I don't think any of those edits were nefarious, they all seemed reasonable. Software assets (kind 3063) are regular events that carry version information, those could be kept around, however if I had social signal that a key was compromised I would stop trusting it altogether. If I already have the software installed and I believe it's pre-compromise I would keep running it. Developers are encouraged to use bunkers, not hotkeys. In addition I just introduced this:

NostrHub

NostrHub | Discover and Publish NIPs

Explore official NIPs and publish your own custom NIPs on NostrHub.

which has support in zsp (publisher tool) but not the UI yet. Interesting model because to compromise it you kinda need to hack *both* keystore and nsec -- for updates at least.