[anaphor]

Arch Linux has PGP signatures and is over https, as well as torrents which should be pretty reliable https://www.archlinux.org/download/