When you download the distro you want off the website, just make sure to grab the asc file and signature. Its the same as verifying for example coldcard software, or new version of sparrow