[RaleyField]

It's a bit convoluted. Follow this guide - https://help.ubuntu.com/community/VerifyIsoHowto

If you are running Ubuntu then you already have signing key (run apt-key list), otherwise you can compare the full fingerprint with the one printed in terminal output in the guide that's hosted on https.

[btrask]

It's on HTTPS, but it's also a Wiki that anyone can edit. This is the most recent change: https://help.ubuntu.com/community/VerifyIsoHowto?action=diff...