You are not logged in.
I do a daily backup which checks for any changes in /etc and other directories that should not change unless you have done a backup. On Christmas Day someone or something changed the following files:
/etc/pacman.d/gnupg/pubring.gpg
/etc/pacman.d/gnupg/pubring.gpg~
/etc/pacman.d/gnupg/pubring.gpg.tmp
/etc/pacman.d/gnupg/trustdb.gpg
I rebuilt my repositories with pacman -Syy
I reinstalled archlinux-keyring
I am familiar with the shenanigans of cups changing their /etc files daily, but this is a first for me.
I'm posting this as a warning of a possible break-in on Arch Linux systems.
Offline
See archlinux-keyring-wkd-sync.{timer,service}
It will also be updated every time you reinstall archlinux-keyring, as you mentioned.
Using -Syy is a terrible idea for multiple reasons. Stick with -Syu.
Online