Are .pkg/.mpkg originating from Apple codesigned and can be verified?

Cheers everybody,

I wonder if Apple Software that is distributed as .pkg or mpkg files (whether on CD or elsewhere) is codesigned. I know that the program files within the packages are codesigned and I know how to verify these signatures. This, however, can be easily only done after having installed the (m)pkg. At that time it might already be too late, if someone has fiddled with the (m)pkg and added some malware. Then you need to deal with that problem.

So the question is, is Apple codesigning the (m)pkg files such that their validity may be verified before installing them, and how do you verify that signature.

I have tried to use the codesign tool to check for signatures on pkgs on my installation disks, but they did not seem to be signed. Maybe I looked in the wrong place.

Anybody?

Best,

J C