[ric2b]

The releases are signed with well-known keys.

But if you don't trust the devs you'll need to use other software, yes.