Always check the PGP signature or hash of any security related software you download, especially anything from the Tor Project website or GPG software. Sadly these procedures are less straight forward than they ought to be, but you should still do them every time.