I just install NetBSD in from ISO image inside VirtualBox.
Official source ISO media contains only MD5/SHA512 sums.
Similarly pkg_add binary packag repository contains only SHA512 sums.
Both FTP and HTTP distribution channels is unsecured and check sums file transfer may be altered.
Is digital signature used by NetBSD project?
How enforce checks for package integrity when
pkg_add is used?