The parent explained they might not trust verification on the target system. This might not necessarily be because the target is assumed malicious, but it may o

The parent explained they might not trust verification on the target system. This might not necessarily be because the target is assumed malicious, but it may only have e.g. md5sum and not sha1sum available etc. (I'm obviously no expert... the hashing examples are just examples here) I intended to suggest you could download it on a separate system which you do trust and verify it there. Then transfer it to the target system.