If I had known they had GPG signed hashes, my work flow downloading the distro for the first time during the compromise would have been as follows: 1. Get key

If I had known they had GPG signed hashes, my work flow downloading the distro for the first time during the compromise would have been as follows: 1. Get key id of the key used to sign the hashes. 2. Google for key id. Hmm, no one's used the key id before, that's odd. Not in my web of trust. And it doesn't match the key id mentioned on other forums/scripts/sites. I'll definitely hold off until I can verify the key directly with one of the distro maintainers. Even if you haven't previously established trust, GPG can be an extremely valuable ally.