Even if the "last mile" is secure, unless the whole process is secure, doesn't matter if the download is secure; case in point, find a oss project that document

Even if the "last mile" is secure, unless the whole process is secure, doesn't matter if the download is secure; case in point, find a oss project that documents their build process to see if security is baked in; hint, of often it is not.