In theory if you got a good original OS download the package managers would be doing all this verification automatically.

Maybe that's acctually a good idea to consider as some sort of specification. Large file download via HTTP with some HTTPS checksum available via a single click.