People should only sign a key under at least two conditions:

The key owner convinces the signer that the identity in the UID is indeed their own identity by whatever evidence the signer is willing to accept as convincing. Usually this means the key owner must present a government issued ID with a picture and information that match up with the key owner. (Some signers know that government issued ID's are easily forged and that the trustability of the issuing authorities is often suspect and so they may require additional and/or alternative evidence of identity).

The key owner verifies that the fingerprint and the length of the key about to be signed is indeed their own.

--

...debian is INDEED old-school and slightly derpy (see their use of the condorcet voting method), but it has boded extremely well for their longevity. Debian exists for its users, and its users are generally developers.