It's trivial to fake gpg short key ids:
http://www.asheesh.org/note/debian/short-key-ids-are-bad-news.html
http://yro.slashdot.org/story/11/12/27/0044242/gnupg-short-id-collision-has-occurred