-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
When I install software, I'd prefer to have a secure delivery mechanism. Qubes OS uses a relatively robust system. A master signing key is kept on a “dedicated, air-gapped "vault" machine”. This key certifies dedicated keys for each major release.
Sadly, I don't have a good way to verify the Qubes master signing key. Instead, I tried downloading the Qubes key packet from various different network endpoints, and over a bunch of different Tor circuits. I asked some friends to try the same thing. We all got the same results.