Yes you download the signatures, but you need to trust the key which created the signatures. Distributions come with that key pre-trusted.