I'm surprised more distros don't just offer you a .torrent file over https. After you get that from a trusted source, you can download the files/ISO/image from

I'm surprised more distros don't just offer you a .torrent file over https. After you get that from a trusted source, you can download the files/ISO/image from wherever (webseeds, random people on the Internet) and the torrent client will do all the checksumming for you automatically on the fly. It's also easy, simple and cheap to maintain while already being popular enough among your target audience. Certainly more people know how to run a torrent download than how to check GPG/PGP signatures or even would run a regular checksum.