"To say that this is in any way insecure because package transit isn't done over an encrypted link is lunacy." The author was referring specifically to the dow

"To say that this is in any way insecure because package transit isn't done over an encrypted link is lunacy." The author was referring specifically to the download page itself. As they correctly point out, the checksums and keys themselves can be modified if the page isn't served securely. As for 'trusted keys', that doesn't help someone downloading the ISO for the first time, who hasn't previously verified a download from that site (how do they know if the key fingerprint is the correct one?)