GPG is great for offline signatures, which in addition to HTTPS is a great way to assure that the software you obtain is legitimate. That isn't to say that it

GPG is great for offline signatures, which in addition to HTTPS is a great way to assure that the software you obtain is legitimate. That isn't to say that it isn't the product of a targeted trojan signed with a stolen GPG key.