Study: Attacks on package managers

No, they're not signed. This means the SHA1/MD5 checks only protect you from corruption during
the download (or subsequently on disk, before the package has been built).

You can prove this yourself - you can modify the downloaded package and regenerate those
hashes with a "ebuild ... digest" command, so there's no secret to it.

Portage is, I believe, quite vulnerable to compromised mirrors at present. I believe the
groundwork to GPG-signing (not sure if that covers the package only, or whether it includes
the metadata) has been done some time ago, but it's not progressed to the point where that's
utilised yet.