Key was included in the repository for a purpose - the public key comes from another place than repo itself and its integrity is provided by Git and then Chef server. This way it's not possible for attacker to substitute a different key together with a different repository (e.g. by inserting an http proxy).