The answer to these questions is that you need to be able to verify the integrity of your key system files. There are a number of tools available that can do this.
RPM comes with integrity-checking built in.
See the man page on rpm for more details. Another utility that is very useful for verifying the integrity of key system files is the md5sum command. The fingerprint is strongly dependent upon the contents of the file to which md5sum is applied. Any changes to the file will result in a completely different fingerprint. The fingerprint can be used to correlate the integrity of the updated package before it is installed.