Comment by xorcist

For something as significant as an operating system, please always check the gpg signatures. Do not rely on transport security.