Well, for starters, the SHA256 signatures are on both the Audacity website and its FossHub page. You can check if both places match, which makes it less likely

Well, for starters, the SHA256 signatures are on both the Audacity website and its FossHub page. You can check if both places match, which makes it less likely to be from an untrusted source. They even have a page explaining how to check the signature. If you're on macOS, before mounting a disk image the system will verify its checksum. Additionally, the default security settings only allows applications from the app store and identified developers. You can use the codesign tool (codesign -dv --verbose /Applications/Audacity.app) to verify the code signature as well as display the signing identity. In this case, it's signed by Paul Licameli, which is the author of this blog post. With that said, it's not foolproof, as the TeamIdentifier is not publicly posted anywhere, someone could possibly create a Developer ID with his name.