Switch to debian release archives, verify signatures
    
    At least on Fedora try to verify signature inside dsc file, which
    provides full release verification. Use dscverify tool to parse the file
    and ensure the signature is valid.