Validity checking - should be mandatory?

That makes sense, but I think I saw installation begin after a few of the downloaded files were corrupt. That is, apt-get might verify the signatures after downloading, but it doesn't first verify them all and only if they all pass then actually begin installation (or, at least verify that all dependents have been verified ).

That, or I really misanalyzed what was going on in that system - could be. But I did see the actual downloaded files were corrupt, and that installation did begin and only halted somewhere during that process.