I can check that an Ubuntu iso file is indeed untampered using the public keys already present and trusted in my Ubuntu system.
Now I want to switch from Ubuntu to Arch and I wonder how I can start trusting that the image downloaded for setting up Arch has not been tampered?
I know that I can use cryptographic hash functions like sha256,sha1,md5 even though that these are transmitted via the same channel (hence an attacker would just switch the hashes to fit to the tampered iso).
Now is there a strategic way out? i.e. do some distributions cross-sign their isos or public keys so that I can verify isos without leaving a trust-chain I already bought in?
As an alternative, should I redownload the md5 from different sources, on different machines and at different times to make an attack more troublesome?
is this the suggested procedure?