Thanks! Fedora was one I didn't try (to install; I use it all the time). However there's still no way to use RPMFusion: http://rpmfusion.org/keys

Maybe there's something I'm missing?

Arch Linux has PGP signatures and is over https, as well as torrents which should be pretty reliable https://www.archlinux.org/download/

RPMFusion isn't considered part of Fedora. Yes, it would be nice if RPMFusion served hashes securely.