You run right back into if you don't already trust the signer of the checksum, you can't trust the checksum, either. The next logical step is some kind of thir

You run right back into if you don't already trust the signer of the checksum, you can't trust the checksum, either. The next logical step is some kind of third party authority, and then you right right into the Certificate Authority problem set, including code signing licenses like Apple and Windows use. Some F/OSS systems are starting to use similar systems, like the newer Python package distribution systems.