[victorbjorklund]

Can you honestly say that you never ever updated anything in a Linux distro without first reading all the code, comparing all the checksums etc?

[aragilar]

The checksums are verified automatically, based on a key bootstrapped by the original install (which could, though likely not done, be verified by other means). As happened with xz, you either get everyone or no-one.