What I do is upload my downloads to VirusTotal. That way I can get assurance it's the same file that's been around for a while. Hopefully if it was Trojaned, someone would have reported it. Certainly won't stop a secretly compromised version, but it's a start.
I do that too, but it's no kind of assurance as any half-competent hacker would test his trojaned versions against various anti-virus software and when it passes all upload it to VirusTotal and similar sites to convince people who rely on such sites. Best thing you can do is to download it from multiple internet connections (via VPN/TOR) and hope that any mitm is closer to your side and not server's side.
