I was always wondering how people could sign those downloads ,thanks for the tutorial theymos

The server hosting the download may also have been compromised
Are you speaking about scenarios that could happen ? or there is an actual threat going on, because I don't understand why It became suddenly important to verify signature while we didn't see such a thread in the past.