This is a big improvement over the previous setup, but I feel that it could do with handling the most insecure part of the process: downloading and verifying the tails iso.

It would be great if this installer could leverage the trust I have in my system to painlessly acquire and then validate the tails iso, without having to deal with

I just tried feeding a regular debian iso to the installer and it didn't complain at all. This shouldn't be possible - what if this was a bad tails iso?