I do a daily backup which checks for any changes in /etc and other directories that should not change unless you have done a backup. On Christmas Day someone or something changed the following files:

/etc/pacman.d/gnupg/pubring.gpg
/etc/pacman.d/gnupg/pubring.gpg~
/etc/pacman.d/gnupg/pubring.gpg.tmp
/etc/pacman.d/gnupg/trustdb.gpg

I rebuilt my repositories with pacman -Syy
I reinstalled archlinux-keyring

I am familiar with the shenanigans of cups changing their /etc files daily, but this is a first for me.
I'm posting this as a warning of a possible break-in on Arch Linux systems.