When downloading a Linux installer iso, the user is supposed to check the iso with sha or m5sum and compare the result against a checksum file, and then check the gpg signature of the checksum file.
If I understand it right, the checksum is to test for iso integrity (iso not corrupted) and that gpg checks that the checksum was not manipulated. So why is the iso itself not signed?