Slight chicken and egg problem there, agreed. You can check the package signatures for the downloaded debs in /var/cache/apt/archives by following the links fo

Slight chicken and egg problem there, agreed. You can check the package signatures for the downloaded debs in /var/cache/apt/archives by following the links for your architecture at the bottom of https://packages.debian.org/wheezy/apt https://packages.debian.org/wheezy/apt (You might need to check the rest of the apt-related debs as well. Just replace apt in the URL with the relevant package name and follow the links at the bottom to get the package hashes. If you're tracking sid instead of wheezy then just replace the distribution name in the URL.)