Signing moves the problem elsewhere. The problem then becomes the key exchange. How do I, as a first time downloader, know that the key listed on the website is

Signing moves the problem elsewhere. The problem then becomes the key exchange. How do I, as a first time downloader, know that the key listed on the website is the correct one? It's the same problem SSL has, sure, there's a key, and your browser trusts it, but how do I know that this key can really be trusted?