Verify package signatures via air-gapped machine prior to install, they did mention downloading to usb using another machine.