Doing it right is a pain in the butt.

FWIW, literally anyone can sign the OpenBSD releases and say "If your download matches this signature, it's the same as I downloaded from six different mirrors on three continents." Nobody does.