Are the gapps (e.g. from goo.im) signed in a way that prevents tampering? Is there a way to verify they're the same as you'd get from Google?
Do all / most ROMs check for this?
As Michael Hampton's helpful answer says, all android apps are signed. This means:
All of this does not mean that a recovery console like TeamWin or ClockworkMod recovery will properly check the signatures of these keys.
Do common roms check the signatures on zip files?
Can we be sure that the apps came from google?
All of this checking brings us back to the keys found in /res/keys. I'm not sure (yet) where these come from. I will try to check and update this answer. One would hope that this is where the Android system stores the keys it uses, which would mean that the signed zip file must be signed with a key from an already installed app.
Even if that is true, any of the keys in
All Android apps are signed.
Android will not run an unsigned app. In addition, the signatures are tied to the app permissions, such that if the signature was wrong, other apps would not be able to talk with it, and you would not be able to receive updates to it from Google Play.
Android signing is discussed in more depth in Signing Your Applications in the Android developer documentation, from which the above information was drawn.