Since it could be intercepted, https wouldn't protect much in your use case. Though I have no reason to believe it's been compromised strangely the key is not present on any keyservers I know of.
gpg --keyserver pgp.mit.edu --search-keys B05498B7
gpg --keyserver keyserver.ubuntu.com --search-keys B05498B7
Might be better if they reissue one given it's from 2012 and includes a revocation
pub 2048R/B05498B7 2012-12-07
uid Valve Corporation <[email protected]>
uid [ revoked] Valve Software LLC <[email protected]>
sub 2048R/C081CFD1 2012-12-07
Don't know about other distros but the steam RPM most people use doesn't include their key either.
Hello @seuri, https://repo.steampowered.com/steam/ currently points towards https://repo.steampowered.com/steam/archive/stable/steam.gpg, which looks like it satisfies the initial chain of authenticity you were looking for here.
Nothing extracted yet.
Your system information
Steps for reproducing this issue:
I would like to download steam but downloadsite is not https protected ( http://repo.steampowered.com/steam/archive/precise/steam_latest.deb ) and keys as well ( http://repo.steampowered.com/steam/signature.gpg ). I would like to reach the keys securely for example hear on GitHub.