Incredibly, there does not appear to be any way whatsoever to securely verify downloads from respected openSUSE.
Seriously? the author has no idea what they're talking about
"For each ISO, we offer a checksum file with the corresponding SHA256 sum. For extra security, you can use GPG to verify who signed those .sha256 files. It should be 22C0 7BA5 3417 8CD0 2EFE 22AA B88B 2FD4 3DBD C284."
https://en.opensuse.org/openSUSE:Tumbleweed_installation
http://download.opensuse.org/tumbleweed/iso/openSUSE-Tumblew...
http://download.opensuse.org/tumbleweed/iso/openSUSE-Tumblew...
http://download.opensuse.org/distribution/leap/42.1/iso/open...
http://download.opensuse.org/distribution/leap/42.1/iso/open...
All signed, happy and healthy...and regularly checked.. people really should double check before making statements like this..