You know which site you're getting it from..check the SSL certificate and that's enough. If an official site got breached it'd be found out pretty quickly.

This point just compile from source

You're being a little paranoid.

What is the benefit of a gpg signature over a checksum? In either case you have to trust someone.

(My opinion) No, you aren't paranoid. I'm thinking a bit like you, but I also consider probabilities. You need to download the checksums from the official website and the ISO from mirrors. Two different sources would need to be hacked. This is where I say, it's hard and secondly someone would notice that hack very quickly.

Signing the ISO or the checksums with a well-known signature is still important. I verify it, if a signature available. It's just a couple of seconds and doesn't cost anything.

No, and yes

A partly because there is always small risk involved in everything in life. However, you do need to realize what the paranoia is supposed to help prevent. If you install an unverified os thar hijacks the machine, then you will need to live the loss of the machine. Particularly, your paranoia stems mostly because you are afraid of losing your privacy or machine to a possible malicious attack. The proper way of mitigating this is to build from a verified source instead, as in you know what the code is, but you can't because the systems are too complex for a single person to verify manually. Unfortunately, your paranoia is too shallow and unfounded, and you will need to do some self reflection to come to the acceptance of a world you can not know or control.

On the other hand, when you are doing proper procedure to do a basic verification step to prevent corruption or possible simplistic malicious attacks, it is good behavior. It great you feel the need to verify your distributions and that your paranoia is likely not paranoia at all! A simple checksum is nice. Also, how can you verify that a gpg key is also a good one and not a tampered gpg that matches the tampered ISO? There is a level of trust you have, and your paranoia is simply never going to be able to be paranoid enough to encompass everything. You are forced to place some trust in something. After all, there are vulnerabilities found in gpg software that does either the encrypting step or verification steps(either from gaining the private key or the verification step throwing false positives). There is only so much we as normal people can do.

So overall, it is both. You are responsible, and your paranoia is too shallow to be useful for you. Go the extra steps and compile from source. It is safer because the code is less likely to be tampered and you can know it is right because you made it yourself.

There is being careful, and there is "The sky is emitting a weird tone of blue. Am I going to die?" kind of "being careful".

From where would you get the public GPG to verify the signature with? How do you know this specific key is the one to trust? Like @tony above said, the best verification when you have no pre-existing trusted channel is the SSL certificate of the website you get the ISO from.

Each individual package is also signed.

I'd say paranoid, most Linux installers download packages from the repositories anyways, so must ISOs are just a way for you to boot the installer.

As a person who takes a belt-and-suspenders approach to security, I agree with you and I do the same.

When I make a code change, even just to a comment, I run the full regression test suite again.

Are these mutually exclusive?

Going a little overboard there in my opinion. If one of the major distributions would catch something sketchy, a whole bunch of tech savy would be all over it in no time.