The download page does not link to a mirrored download directory. There are no sigs or hash files. There is no link to a KEYS file, and no description of how to check the integrity of downloads.
*** This bug has been marked as a duplicate of bug 48604 ***