Relatively Linux Newbie here. Been playing with flavors of Linux/Unix/BSD for a few decades but only recently moved to having one as my primary OS.

My question is: Since I don't think of myself as a person of interest, is there a solid reason to do things like validate hashes or signatures when I get packages from a non-standard repo?

For example, I want to do something with a tool that doesn't have it's own repository. They have a website with a .deb or .tar.gz download and an accompanying signature file or hash. There are instructions for grabbing the public key from their domain so I can verify the file or there is a hash text string.

I can go verify a hash or signature... but if I got the file and the signature from the same place . . . If an attacker wanted to hand me bad code, couldn't they also hand me a bad signature/certificate/key?

If I was given a flash drive with a tool by a random person, then I might want to validate it, but if I download a file from an org that I went to on purpose then the org giving me their key doesn't seem to do much. Aside from file corruption, there's nothing to prove and a corrupted file is likely to fail in other ways such as a .gz checksum.

I'm not saying the practice is bad. But if I'm not important enough to have someone waiting to intercept my random app download and give me a backdoored version and I trust the developer to not be giving me malware in the first place, is there a need to verify?