All the downloads are "signed". This means that someone (in this case Erinn, a Tor Project Developer) vouches that the software is good and hasn't been tampered with.
You can verify the download by also downloading the signature file, and using GPG to check that the signature is valid for the downloaded file, and that they were signed by Erinn.
More detailed instructions can be found https://www.torproject.org/docs/verifying-signatures.html.en
The question of how you can trust the signature is in two parts. Firstly Erinn's key has been signed by many people who claim to know Erinn. You could also go to a real-world event where Tor Developers are present, and ask them to verify that your copy of Erinn's key is legitimate. Many of the Tor Developers have signed Erinn's key with theirs, so having them confirm their own keys for you will help you build a web of trust. Secondly the Tor Website serves downloads over HTTPS, preventing modification in transit, unless you are being actively attacked by someone with the power to get illegitimate SSL Certificates issued.
Once you have the Tor Browser Bundle, updating should use the same process of verifying signatures. Whether you download the update over Tor or not is up to you, but verify everything.
In addition, there are things called "Reproducible Builds" that are being worked on, and eventually you'll be able to create your own version of the Tor Browser Bundle from scratch, and be able to verify that it matches the version that everyone else has obtained. Further details on that can be found in this blog post https://blog.torproject.org/blog/deterministic-builds-part-one-cyberwar-and-global-compromise
