It shouldn't matter where you're downloading the TBB binary, since you're going to verify the signature before trusting it, right? Surely you wouldn't just assume it was legitimate, and then install it.

Business idea: signature database with web interface. So download from anywhere, and look up the signature on the database to verify its authentic.