Yep. MSYS2 uses pacman's support for GPG signatures. The links to the installers on the website don't use HTTPS, but it looks like they've added checksums of th

Yep. MSYS2 uses pacman's support for GPG signatures. The links to the installers on the website don't use HTTPS, but it looks like they've added checksums of the installers to the website itself, which is served over HTTPS.