A user/attacker can add the same key several times and add the same signature as many times during release and publication.