> You can manually and independently check the image signature before flashing an update.
Of course you can. You can also read the ToS before clicking accept, but who does that?
People who don't want to find themselves inadvertently participating in a botnet.
I'm sure there are dozens of us.