Where do you get the public key to verify the signature from? My point being, that you have to trust someone. I don't really see the benefit of trusting a key server, that the public key really belongs to the owner over a checksum file being published on the website of the owner.
Me too? ☺️