Public key signatures would be even better. Then you only need to install / audit / trust the public key once, versus updating the checksum for every new releas

Public key signatures would be even better. Then you only need to install / audit / trust the public key once, versus updating the checksum for every new release. Of course, this assumes that signing isn't compromised too, if that's the case then you're pretty much out of luck since a malicious release would be superficially indistinguishible from a real release.