I got back the checksum, but I have nothing to which to compare it.
I know Apple publishes the SHA info for "updates", but I have not noticed them posted for full OS installers.I only found it in one thread. Apple's site was no help, at least as far as I could find. My other concern is that I can't get an "Apple Signature Check" on the download.
… /Applications/Install\ OS\ X\ Yosemite.app/Contents/SharedSupport/InstallESD.dmg …
http://apple.stackexchange.com/a/150908/8546 – an accepted answer.
Does what you downloaded match?
If not, you might like to name and shame the dubious source.
I'm guessing it won't compress enough to fit in the free 2GB DB account.
… My other concern is that I can't get an "Apple Signature Check" on the download.
… I just didn't know if I could trust that …
It sounds like perhaps you have downloaded the installer.dmg itself and not the full .pkg file that would have the certificate. What happens for example if I downloaded El Capitan today from the App Store is I would get a .pkg file with data inside that file identifying that .pkg as having been downloaded with my AppleID. And that .pkg file would have the certificate mentioned.
You mean as the .pkg file? Yes, very close in size.isn't the .dmg about the same size anyway ?