Verifying the signature is the only way to be sure that the downloaded file is the one uploaded by ThomasV (assuming that ThomasV knows how to protect his signing key, which he most probably does).
If the user does not check the site, he will not verify the signature. Verification of the signature is important in hacking the official site cases but will not be useful in such cases.To solve the problem definitively there must be collaboration between browsers and search engines. There is an authentication badge next to each official account "just as it happens in social media" and therefore when a person visits any site similar to the official domain the warning appears.
