honestly, I wouldn't be so hard on yourself. This stuff is way harder than people think. People don't realize how hard it is to establish trust starting from none. Normally you type a website into Google, and Google has already done the work for determining which website is the legit one and which is the shady phishing site, and will filter out the shady site. This convenience does not exist for darknet sites, so you just have to establish trust yourself.

even asking for the true php keys from you right now is submitting to defeat

not necessarily. You can get the pgp keys from random strangers online. It's just not the only source you should rely on. Get it from multiple sources and then verify if they are all the same. If they are, think to yourself how likely it is that all 3 sources are actually the same attacker giving you a fake key.

DM me if you're actually interested in the pgp key and I'll dig it up from my notes