Arch Linux

When installing virt-manager i was asked to add key from Angel Velasquez for python2-cairo package. But i couldn't find him on dev list (https://www.archlinux.org/master-keys/) - point of reference for me. So key verification was not possible, so i emailed him and Angel was king enough to response and indeed confirm my thought that he was not developing for arch anymore.
I know i sound paranoid here, but what is the point of key signing if we just go and accept everything that comes along. I have no reason, especially after communicating with Angel, not to trust/import his key, but this is not my point. If his key is still regarded as trusted/valid, although he is not dev any more, he still should remain on the list until someone takes over and resigns the package.