Installation media signatures?

[6E7368]

I was about to flash the rpi3 12.1-RELEASE img to an SD card, but I couldn't find any signatures to verify it against. Am I missing something, or are users supposed to install unverified images? Checksums without a signature are not an assurance against tampering.

I didn't find what I was looking for in the handbook or with Google, and I thought I'd ask here instead of bugging the security mailing list.