I finally found the time to sit down to this during the weekend, and it turned out points 1-5 were super easly (thanks to your guide)
Now, I will try to do the "fun part" - point 6
One more general question:
Suppose I somehow fail to properly verify the bticoin core file, and somehow manage to download a tainted version of bitcoin core.
IF I interact with bitcoin core only through my hardware wallet,
then
I understand that the worst that may happen is that I will be somehow "mislead" by the fake btc core, and if I send my coins they may end up in some other address than the one shown on btc core.
However, when interacting through a hardware wallet my coins are still safe as long as I don't move them. In other words, the malicous third party running the tainted btc core cannot access my coins, it can only mislead me, and cause me to send my coins to their address.
IF the above is correct, then I understand that the best precaution would be always sending small batch of btc first. Then open some third party trusted btc explorer (multiple at best) and verify without using btc core that the coins actually went to the adress they were suppose to go?
So, with the "fun part" (use GPG to check the SHA256SUMS file), I got stuck here:
Quote
To use the Search feature, copy ThomasV's fingerprint from a trusted source and enter it into the provided search field.
ThomasV's fingerprint is used when checking the Electrum file, but how do I get the fingerprint for BTC core?
I asked GROK for help
GROK told me to find a list of these keys in the Bitcoin Core GitHub repository under contrib/builder-keys/keys.txt
I managed to get to the contrib folder as instructed by GROK. But inside this folder there is no "builder-keys" folder as GROK claims