The big problem is there are no really good ways to deal with this problem fully.
If you use digital signatures, you have to have a trusted method of distributing the verification keys.
If you have a secure method of distributing keys, you could also just distribute the encrypted file (or its hash) via that secure method.
Digital signatures usually work best when you previously had a secure channel but dont anymore (which is actually fairly common). But once you start doing that, often you start to want doing complex key management (e.g. PKI, tofu etc. Who manages the trust store), and how most appropriately to do that can be application specific (lots of tradeoffs and all options suck in different ways). So i kind of get why the author wants people to use a separate tool for that (even if it is a bit of a cop out).
> Did you find the book a bit deep? I have no intention of writing my own crypto, i just want to use it reliably and correctly.
Its been a while since i read it, but it was mostly about how to use different crypto primitives properly. It was not about how to design a block cipher or anything like that.