Surprisingly, the .zip files themselves contain an embedded TLS signature. There's a link in the footer of the download page which explains it. But you're rig

Surprisingly, the .zip files themselves contain an embedded TLS signature. There's a link in the footer of the download page which explains it. But you're right, it's not GPG, and hence no web of trust behind LineageOS.