imagemagick.org imagemagic.com That's a good way to illustrate the GP's point. As long as downloads are always provided from the official domain via HTTPS Y

imagemagick.org imagemagic.com That's a good way to illustrate the GP's point. As long as downloads are always provided from the official domain via HTTPS You are conflating control over the public website with control over the build/signing infrastructure. A good defense-in-depth strategy means that a compromise of one should not lead to an automatic compromise of the other.