Sign new releases with a GPG master signing key.

Currently, if a user wants to verify the integrity of their download, they are directed here:

https://elementary.io/docs/installation

...where the documentation walks them through the process of verifying the sha256 sum of the .iso file they downloaded.

This is a great first step, but the twin linchpins of this whole arrangement are the elementary.io TLS certificate and the admin access to the site.

Anyone who can issue root certificates is currently in a position to serve users malicious copies of elementary OS. Currently, there is no way to detect this.

In addition, if the elementary.io website were compromised, it would also be possible for an attacker to silently serve malicious binaries, even if they cannot issue root TLS certificates.

Offering users the option to check a GPG signature on either a sha256 checksum file or the .iso file itself would solve this problem.

Other projects, such as Debian and Qubes OS, among others, have opted for signing their releases with an offline GPG signing key.

As the Linux Mint developers discovered, you do not want your website to be the single point of failure in your release security:

http://blog.linuxmint.com/?p=2994