How to verify this download
===========================

  sha256sum -c SHA256SUMS

  gpg --verify SHA256SUMS.asc SHA256SUMS
  gpg --verify huios-2.1.0-amd64.iso.asc huios-2.1.0-amd64.iso
  gpg --verify release.asc release      # the update feed

Checking the signature matters more than the checksum: a checksum
served from the same place as the image proves nothing if that
place is compromised.