> (unless the main site is secure but the downloads aren't > which is idiotic by 2016 standards anyway), the site > getting hacked, etc. It's not idiotic at

> (unless the main site is secure but the downloads aren't > which is idiotic by 2016 standards anyway), the site > getting hacked, etc. It's not idiotic at all. You let anyone who wants to spread the load by providing downloads, but you use checksums - behind https - to ensure they can be trusted.