If you're validating the signatures properly, then it's impossible for a malicious attacker to adjust the signatures in a way that they will still validate. Ho

If you're validating the signatures properly, then it's impossible for a malicious attacker to adjust the signatures in a way that they will still validate. However, validating the signature properly involves you being certain of using the correct public key. This is the tricky part. Being in the PGP strong set helps with this. Using HTTPS gives you some confidence, but no protection against server compromise. Once you do have the correct public key, however, you can be protected against server compromise for all future releases, too. Or, at the least, you can verify that future releases are coming unmodified from the same origin.