It's impossible to force install the packages when they have bad hashes (hence the severe breakage here), and it is possible to install the packages when they h

It's impossible to force install the packages when they have bad hashes (hence the severe breakage here), and it is possible to install the packages when they have bad signatures if you didn't import the gpg key or don't run with signature checking. So I'd guess a rational attacker would choose a bad signature. But attackers can be irrational; it doesn't prove it's not an attack. Just not my intuition.