Do you really think it will be hard for the US gov to make sourceforge put backdoored binaries up on the only mirror we have today?
Fixed that for ya
We would notice within hours if they did that. You see, the SHA-1 hashes of all official releases are PGP signed by a trusted developer, and people DO check them every now and then. It'd be great if we had a bot check them, though.