Thank you, that was indeed a typo I wrote as I rushed to get out the door earlier. I obviously meant to write &quot;if you&#x27;re downloading the public key&quot; (indeed, I referred to &quot;download the public key of the signer&quot; in two paragraphs up, so I suspect that was clear to most people reading).  The hashes for each new version are what are signed, obviously (with the private key of the maintainer).<p>My sentence about &quot;trusted signature&quot; could have been clearer, too.  You have a public key that you trust, that you leverage to verify any new materials signed by the package&#x2F;distro maintainer.  So by extension, you can trust the signed hashes.<p>I&#x27;ve been using PGP&#x2F;GPG on a regular basis since 1998, so I&#x27;m pretty used to the workflow by now and not at all confused about key pairs and signatures (although I will admit that I sometimes got confused about the point of subkeys until I read this a few years ago: <a href="https:&#x2F;&#x2F;alexcabal.com&#x2F;creating-the-perfect-gpg-keypair&#x2F;" rel="nofollow">https:&#x2F;&#x2F;alexcabal.com&#x2F;creating-the-perfect-gpg-keypair&#x2F;</a>)