Nevertheless, if I download a package from a website, it's often accompanied at least by a checksum that I can use to validate non-tampering. I don't fully grok all the threat surfaces that are ...