The BEP suggests that torrents that do this should include a public key in the original torrent, and then the update must be signed with the corresponding priva

The BEP suggests that torrents that do this should include a public key in the original torrent, and then the update must be signed with the corresponding private key. So the idea is if you trusted the original you should trust the update.