Sure, we check signatures too. (At least, Cargo does. I think rustup may not in some circumstances? I forget) It's about defense in depth.

I am a Windows user, I know that. That's why i said "if" :)