Extension downloads are validated using a signature check to prevent tampering!

(I work for DuckDB Labs and MotherDuck)