For nm.debian.org, at 2021-09-30:
For the past 6 months, I have worked with Ma Aiguo on DDE-related packages in Debian.
For this past work, Ma Aiguo sent mails using the email address firstname.lastname@example.org
which is the one they're using on nm.debian.org, and they signed their work and
email using a GPG key with fingerprint 277A 69AE 7760 6279 FF32 9788 31CC 9967 66F0 5BA0.
I've made sure that they are able to decrypt encrypted messages sent to this key
and that they're able to sign messages with the same key.
Due to the long-term interactions we had, I'm convinced that Ma Aiguo as they
present themselves on nm.debian.org is the rightful owner of both email
email@example.com and GPG key 277A 69AE 7760 6279 FF32 9788 31CC 9967 66F0 5BA0.