I want to verify that a downloaded ISO is not being poisoned by the NSA or any other immoral agent. To do this I would very much use a signing-checking way.
I am aware of VerifyIsoHowto. Still I am not very happy with offered. If some agent can manipulate one file download he surely can manipulate all file downloads. So the public key I get from a key-server can just be cheated to make the manipulated ISO file check okay, while indeed it has been injected a rootkit or worse.
Now I am aware of that there is unfortunatelly no 100% sure way. But starting with the assumption that my current system is safe I have those keys used in the SecureApt mechanism.
My Question therefore:
How can the keys that I already trust in SecureApt (= the ordinary Ubuntu repository keys) be used to verify a freshly downloaded ISO?
Indeed it would serve me well also if I could via the Ubuntu Repo (and hence in a deb that is verified implicitly via SecureApt) get those public keys which would be necessary to verify the signature of the iso.
Any help would be greatly appreciated.
PS: of course I am aware that if Canonical is immoral and colaborates with NSA (which has money hey) we are all poisend anyhow. Let's just assume something like this could never happen, ok?