Comment by philjohn

They cover this - timestamps are embedded in the packages, and also signed. If they're too old it won't update and you'll know something is amiss.