PureOS has SHA256 verification of download, but I've heard that SHA isn't so secure. Do they sign their files or provide associated .sig files? And is it true that that would be more secure?
Your question seems a little confused about a couple of concepts. Lets start with basics.
Hashes, Signatures and Certificates
Hashes are generally used to ensure integrity and prevent someone from tampering with a file or message. Where you already have the hash for a file and you trust that you have been given the right hash, you can check you have been given exactly the right file by checking if it matches the hash. BUT you need to be given a new hash for every new file.
Signatures work using a public/private key pair. They are used to verify that something has been sent by the right sender. You can verify a sender has access to the sender's private key (super secret, only the sender has it) by checking if the signature matches their public key. BUT you need to already know and trust their public key.
Certificates take this one step further. If you don't already have the sender's public key you probably do have the public key of third party certificate authorities embedded in your browser. You trust your browser to have made good decisions about which certificate authorities to trust. You trust those certificate authorities to sign certificates containing the public key of your sender.
What does PureOS do
ISO install images
From what I can see they don't sign their install ISOs on their website. Their website's certificate (provided by letsencrypt) confirms that they own the domain name www.pureos.net. So if you trust that the owner of this domain name is PureOS then you can trust the content on this website.
On their website they post the SHA256 Hashes for their ISO see SHA256SUM link on this page.
When you download the ISO you can use the linux utility sha256sum or similar windows utility to verify the IOS file matches the hash.
This is secure in that it tells you the owner of the website is the sender of the ISO file.
PureOS ships with their public PGP key. When you
apt-get update a repository, a master signature is checked. The repository contains SHA256 hashes for all packages. So when you the
apt-get install a package, the signature can be checked.
Therefore anything you get through
apt-get install should be secure as long as you don't add untrustworthy public GPG keys yourself.
SHA256 is secure at time of writing
You may have heard that SHA1 is not secure. There are many different forms of SHA. SHA1 is being decommissioned for anything related to security because it's believed that it's too easy to crack. More accurately its too likely that someone will be able to generate a new file matching an existing hash, where cryptographic security requires this to be impossible.
SHA1 has been replaced by much stronger forms including SHA256. At time of writing (May 2019) SHA256 is still very secure.