If I had known they had GPG signed hashes, my work flow downloading the distro for the first time during the compromise would have been as follows:<p>1.  Get key id of the key used to sign the hashes.
2.  Google for key id.  Hmm, no one&#x27;s used the key id before, that&#x27;s odd.  Not in my web of trust.  And it doesn&#x27;t match the key id mentioned on other forums&#x2F;scripts&#x2F;sites.  I&#x27;ll definitely hold off until I can verify the key directly with one of the distro maintainers.<p>Even if you haven&#x27;t previously established trust, GPG can be an extremely valuable ally.