Even on websites like Electrum, be sure to verify the GPG signature before download. if you were downloading the electrum wallet software, you can use the GPG signature to check that software actually came from Thomas Voegtlin the original developer and the others who have contributed to the source code and also that the website hasn't been hacked and uploaded with fake versions of the software which could be running malicious code that will try to steal your Bitcoin. Well you can check the software and check the signature on it to make sure it's coming from the right people and it has not been tampered with. Do it for every download of any wallet software.