He probably didn't care because it's not much more than partitioning, running debootstrap, installing the few extra packages and copying config.txt and cmdline.txt. :)
That said a gpg signature could be a good thing to add.
Aaaand GPG signature added!
Cool, so now I'm confident that it was sjoerd that compromised my machine ;)