I am first time linux mint user. The only place I can find who the developers are/what keys are used/signed and so on is their (compromised) site. Once we have established trust it is easy to maintain it.
1. Get key id of the key used to sign the hashes. 2. Google for key id. Hmm, no one's used the key id before, that's odd. Not in my web of trust. And it doesn't match the key id mentioned on other forums/scripts/sites. I'll definitely hold off until I can verify the key directly with one of the distro maintainers.
Even if you haven't previously established trust, GPG can be an extremely valuable ally.
As linked in the blog post in my other comment, tails explains things quite well:
Ideally, the keys should be distributed in safe fashion too, so this whole question should be moot.
Though perhaps more trivial when the attacker has helpfully provided your operating environment.