> And since I can verify signatures locally, any time I choose, it would be hard for that server to get away with modifying file contents only when served throu

> And since I can verify signatures locally, any time I choose, it would be hard for that server to get away with modifying file contents only when served through the site, sooner or later someone would catch them out at it. That's only true if they lie to large numbers of people. If they just lie to a handful of people, who will ever know? (And you're probably not connecting through Tor, so there's a good chance they could know exactly who you are.) > the website is https, so I trust that the server I'm asking for the file is the same one that gives it to me. Do you know if they use a CDN?