Every hourly run verifies the signed part of the tree before uploading it:

• texlive.tlpdb, the three installers and the two update-tlmgr-latest updaters under systems/texlive/tlnet/ are checked against their SHA-512 and GPG signatures, with the TeX Live primary key fingerprint pinned in Taskfile.yml. A signature from an expired or revoked key is rejected.
• texlive.tlpdb.xz, the copy tlmgr downloads, must decompress to the verified texlive.tlpdb byte for byte.
• Every package container is checked against the checksum recorded in the signed tlpdb, and the tlpdb goes live only after every container it names is in the bucket.
• A batch that fails any check is not uploaded; the bucket stays at its last checkpoint.
• After each publish, texlive.tlpdb.sha512, a sample of the run's keys and one HTML file are read back through the domain and compared with what was uploaded.

Those are the only files on CTAN with a signature this mirror can pin. Everything else on CTAN, including tlcontrib and the TeX Live ISO images, is copied as served, byte for byte, and carries whatever checksums upstream publishes beside it. tlmgr repeats the signature check on the client, so a tampered mirror is rejected there too.

Uploads are batched. Containers land before the tlpdb that names them and timestamp lands last, so a tlmgr run that overlaps a publish sees the previous tlpdb, never a tlpdb naming a file that is not there.

If you find a way to serve altered or unsigned content through ctan.katoptra.org, or a weakness in the pipeline itself, report it privately through GitHub's vulnerability reporting. Please do not open a public issue for it. Problems with the packages themselves belong to TeX Live and CTAN; this mirror copies what they publish.