If you want, I can outline exact terminal commands to inspect the .dmg safely in a macOS VM, or help draft a checklist for verifying its integrity.
Registration is free and easy!