The checksums are verified automatically, based on a key bootstrapped by the original install (which could, though likely not done, be verified by other means).

The checksums are verified automatically, based on a key bootstrapped by the original install (which could, though likely not done, be verified by other means). As happened with xz, you either get everyone or no-one.