The checksums and PGP signature are on the HTTPS page which links to all the downloads. You have to trust that page from the start no matter what (or establish

The checksums and PGP signature are on the HTTPS page which links to all the downloads. You have to trust that page from the start no matter what (or establish the PGP signature trust from other ways, which is quite possible just far more involved) because that's the source of all downloads and anything there could be faked from mirror links to checksums to PGP signature (assuming no trust chain is actually established by the user). My initial point is that no matter the solutions offered, the user has to care about checking. Forcing HTTPS transport for the download isn't really going to make it any more secure because it's still possible the file is illegitimate and you should be testing the signatures. tl;dr: Arch's downloads are over HTTP, the checksums and signature are over HTTPS and on the official download page.