Thank you, that was indeed a typo I wrote as I rushed to get out the door earlier. I obviously meant to write "if you're downloading the public key" (indeed, I referred to "download the public key of the signer" in two paragraphs up, so I suspect that was clear to most people reading). The hashes for each new version are what are signed, obviously (with the private key of the maintainer).

My sentence about "trusted signature" could have been clearer, too. You have a public key that you trust, that you leverage to verify any new materials signed by the package/distro maintainer. So by extension, you can trust the signed hashes.

I've been using PGP/GPG on a regular basis since 1998, so I'm pretty used to the workflow by now and not at all confused about key pairs and signatures (although I will admit that I sometimes got confused about the point of subkeys until I read this a few years ago: https://alexcabal.com/creating-the-perfect-gpg-keypair/)

Yeah, I figured out that you merely made a simple mistake, since rest of your comment makes all kinds of sense. :) Apologies in case I sounded like I wanted to put you down.