> 1._ by making sure you download a "by-them-crafted" version of knoppix (this is why I think that a central repository of signature info based on https is important)

What is the md5sum of the version that you are using?