I've also filed an upstream bug due to the Lintian pedantic warning of debian-watch-may-check-gpg-signature. That bug can be found here: https://github.com/hexchat/hexchat/issues/895