Are the signatures of gapps from zips checked? Are the gapps (e.g. from goo.im) signed in a way that prevents tampering? Is there a way to verify they're the same as you'd get from Google? 

Do all / most ROMs check for this?
All Android apps are signed.

Android will not run an unsigned app. In addition, the signatures are tied to the app permissions, such that if the signature was wrong, other apps would not be able to talk with it, and you would not be able to receive updates to it from Google Play. 

Android signing is discussed in more depth in Signing Your Applications in the Android developer documentation, from which the above information was drawn.

If you are paranoid and want to verify an app's signature, you can use the jarsigner utility included with the Java Development Kit (JDK). For example:

jarsigner -verify -verbose -certs Vending.apk