For Debian, the author says:
"Official releases of Debian CDs come with signed checksum files; look for them alongside the images in the iso-cd, jigdo-dvd, iso-hybrid etc. directories." No directory or direct links are provided. Verification instructions are not linked to from the download page.
I do:
- https://www.debian.org/CD/http-ftp/
- https://www.debian.org/CD/http-ftp/#stable
- http://cdimage.debian.org/debian-cd/8.5.0/amd64/iso-cd/
And here, along the images, there are difficult to miss (and GPG-signed) SHA256SUMS and SHA512SUMS files. Moreover, the last page clearly links the verification instructions in the "How can I verify my download is correct and exactly what has been created by Debian?" section.