When it comes to violating human rights, defending the rich, suppressing the poor, preserving the corrupt fiat based monetary system, etc., there is only one jurisdiction across the globe, it is the US jurisdiction nowadays. Mirroring doesn't work, decentralization does.
I agree that the only true option is decentralization but not with the other part specially nowadays that the world is slowly becoming a multipolar one as opposed to being unipolar for decades.
But, the attacker carries both the developers' public keys, the binaries / source code, and finally the signatures. Therefore, they have everything needed to alter the software effectively, without notice. For example, I can change Electrum's source code, replace Thomas' key with mine, replace the Thomas' signature with mine, and give it to you. How can you know I've compromised it?
You are forgetting about an essential part of PGP which is called
Web of Trust, you don't just trust any key that signs a binary. You have to first spend time finding the correct key that you can trust then import that and verify the signature that it created.