Today I installed (again) an update for my Ethereum Wallet by downloading a file (Ethereum-Wallet-macosx-0-9-0.dmg) from https://github.com/ethereum/mist, checking it's md5 sum and then just installed it.
But how can I be sure that this version is not tampered with? Both the download source and the md5 hash are published on the same site (github.com) and secured by a single SSL-certificate. As we know the SSL-chain of trust is weak by it's design - ok for everyday transactions but I do not know a single bank which solely depends on SSL when it's customers money is at stake.
Does anyone know a more secure (at least redundant) way of checking if the code I run is released by a trustworthy party?