Thats exactly what i mean - checksums are useless in this scenario. They should have been signed with a key your computer knows. (Retrieved before the first install)
Oh, I see what you mean. I wish I saw a way for that to happen in the Windows ecosystem, although I suppose the "Windows Store" might drive evolution in that direction.
