Huh? The signing key isn't kept online, unlike the binaries. You "remember" OpenBSD's key once, and can detect if someone tries to replace it with a different key.
You thought you were being witty with this "performing artists" stuff, but really this is just florid ignorance.
I think his point was that many people keep the signature in the same place as the actual binaries (most directories of builds of OSS I've seen have a tarball and a corresponding hash in the same listing).
I'll admit I'm probably ignorant about this, but I don't see the point in that. If someone can compromise the binaries, they can also modify the signature files that are sitting in the exact same place.
It's fine to keep the signature in the same place as the binary. Simply being able to modify files won't allow you to produce a valid signature under a PGP key kept offline.
A signature is not the same thing as a hash or checksum. You could modify an ISO and replace the signature, however that would be your signature. To create a signature as say, the OpenBSD project, you would need their private key, which is (hopefully) carefully hidden on some private machine.
So, putting the signature in the same directory as ISOs is a perfectly safe practice (assuming that strong asymmetric cryptography is used, and the private key is kept private).
And look at all the linux distros that do that. Oh right, they don't. They just go "here's our public key" and people download it over ftp from the exact spot they are getting the binaries, do nothing to verify it, and pretend that got them security. Hence, theatre. Anyone who would actually do it right already has the tools to do so, ssh public keys work just like pgp public keys.
You thought you were being witty with this "performing artists" stuff, but really this is just florid ignorance.