NB, the tarballs have detached OpenPGP signatures, you should probably use them for verifying authenticity.