There are still many applications or projects on the net that do not
offer any digital signature or any other kind of verification. I think
this is true for both Open Source and MS Windows. E.g. some Linux video
drivers from video vendors. No signature, no checksum.
I wonder, is there somewhere a kind of "global check sum archive" where
people upload file names and corresponding hash sums?