gpg key used to sign zsh tarball has no trusted signatures so how can I trust it?

[vapnik spaknik <vapniks@xxxxxxxxx>]

Hi,
    the zsh tarballs available on sourceforge & zsh.org are signed by "dana@xxxxxxx", but this key has no chain of trust associated with it, only self signatures. How do I know that "dana" is trustworthy, and hasn't hidden some malicious code in the tarball? I can see "dana@xxxxxxx" listed in the ChangeLog, but that's not much reassurance (it could have been achieved with a simple search-replace).
Considering how fundamental and frequently used zsh is, I think it's very important that we can trust the tarball, don't you?
Here's a suggestion for some of the long term developers; why not contact each other by email and arrange a video conference to get to know each other a little bit, and sign each others public gpg keys?

Joe Bloggs.