Security
One update root.
Morana updates will be authenticated by TUF and by nothing else. That root is not live yet — so today there is no signed build to verify, and the only distribution we can stand behind is source you build yourself.
Meanwhile
What you can actually verify today
This is a testnet. The coins have no value, so the realistic risk of a malicious build is your machine, not your money — but that is reason enough to compile it yourself.