The fact that the package has been there for a long time, doesn’t mean that it itself is still ‘safe’ or its contents haven’t been tampered with - that’s what the signatures are for. So I prefer not to force-trust keys manually, but trust the trust-chain.