You don't have to verify the source yourself. Others can do it. I trust the Debian maintainer for my package. He's a real world person who has had his key signe

You don't have to verify the source yourself. Others can do it. I trust the Debian maintainer for my package. He's a real world person who has had his key signed by other Debian developers. The fact that the source can be verified also reduces the risk of malicious modification. It's not necessarily just the author who might be malicious, either. The author's computer where he runs his compiler might be compromised.