For something as significant as an operating system, please always check the gpg signatures. Do not rely on transport security.