If the website is compromised, the checksum could be changed as well. With digital signatures the problem is that I don't often know who is the official author

If the website is compromised, the checksum could be changed as well. With digital signatures the problem is that I don't often know who is the official author of the app.