A signature is not the same thing as a hash or checksum. You could modify an ISO and replace the signature, however that would be your signature. To create a si

A signature is not the same thing as a hash or checksum. You could modify an ISO and replace the signature, however that would be your signature. To create a signature as say, the OpenBSD project, you would need their private key, which is (hopefully) carefully hidden on some private machine. So, putting the signature in the same directory as ISOs is a perfectly safe practice (assuming that strong asymmetric cryptography is used, and the private key is kept private).