Version control - The gpg public key distribution method provided on git-scm does not seem to be able to prevent content forgery, right?

Question

https://git-scm.com/book/zh/v2/分布式-Git-维护项目#为发布打标签

Maintainer execution:

gpg -a --export <keyid> | git hash-object -w --stdin | git -a maintainer-pgp-pub -m 'Run "git show maintainer-pgp-pub | gpg --import" to import the PGP public key'

This is indeed done, the public key is distributed, the recipient only needs to

git show maintainer-pgp-pub | gpg --import
git verfy-tag <signed-version>

The public key can be imported and verified.

Then the problem is, if the content is forged, and the public key and content are all generated by the forger, then the verification will still pass. This can only be prevented by publishing the public key fingerprint on the site. In this case, wouldn't it be better to publish the public key directly on the site? There is no point in verifying anything!