Before installing a Kubernetes binary, an administrator receives a checksum and signing information through a trusted release channel. What is the appropriate integrity check?

1. Trust any checksum downloaded from the same untrusted mirror as the binary
2. Check only that the executable filename ends in the expected name
3. Verify the downloaded artifact against trusted release digests and signatures where provided
4. Run the binary as root first and inspect its version output only