Look, Im trying to remain patient and explain everything to you. But for this, you will HAVE to read and understand what Im trying to say to you.
AGAIN: You download ThomasVs key ONCE from a well known source, like ELECTRUM.ORG, which is real and not a fake website. Then, everytime you need to download a new update from any website, you use that trusted key to verify the unknown file (you know the PGP key is trusted because you know for a fact that you downloaded it from the real website).
YOU DONT DOWNLOAD A NEW KEY EVERYTIME ALONG WITH THE FAKE SOFTWARE.
AGAIN: You download ThomasVs key ONCE from a well known source, like ELECTRUM.ORG, which is real and not a fake website. Then, everytime you need to download a new update from any website, you use that trusted key to verify the unknown file (you know the PGP key is trusted because you know for a fact that you downloaded it from the real website).
YOU DONT DOWNLOAD A NEW KEY EVERYTIME ALONG WITH THE FAKE SOFTWARE.
Yes Im trying to remain patient and ask everything to you too
But in case i dont have that key and i go to a fake website?
Thats exactly my point. You SHOULD have ThomasV real PGP key before trying to download anything. Then, you verify the file and if the signature is valid, you are safe to use it.
Take some time to get his real PGP key once and everytime you download a new update, you can verify it.