I wonder if this means some sort of third party, independent online data store of file signatures can be referenced to ensure all is OK.
And how does anybody know whether the collection of file signatures has been tampered with?
That is the problem that is supposed to be solved by a Certificate Authority (CA). There are a small number of companies who are widely trusted, and whose public signature keys are widely known. You pay one of them to wrap your public signature key and details of your identity in a digital certificate, and then you disseminate that to your end users.
Your end users can use the CA's well known public key to verify the information in your certificate, and then they can use the public key contained within the certificate to verify the files that you sent them.
It all works wonderfully well provided that the CA does an adequate job of verifying that you really are who you say you are when you ask them for a new certificate. (I.e., You woudn't want them to issue a new certificate in your name to some random hacker who is pretending to be you.)