Please also verify the integrity of the downloaded DMG file. If you have downloaded it open a Terminal and run:
md5 ~/Downloads/MusicBrainz-Picard-2.5.dmg
Adjust the path if you have placed the file elsewhere. The command should output MD5 checksum of b0cf05354bae73bb7ada0cf26f891a43. If it is different the download is broken. In general the files from both mirrors are fine, I just checked them.