Hacker News Reader

Currently all files get verified. The kernel.org admins have digital signatures of all files...

Hopefully those signatures aren't on the compromised machines?

Of course not.

As one of the users@kernel.org members I can tell you that the kernel.org admins are very competent.