> I find the anti-HTTPS fixation equally bizarre Nobody is anti-https here. The point is that it does doesn't protect against software distribution integrity (

> I find the anti-HTTPS fixation equally bizarre Nobody is anti-https here. The point is that it does doesn't protect against software distribution integrity (especially not when mirrors and CDNs are used). Pretending that security would improve with https risks making the problem worse, not better. What's needed is better instructions how to verify integrity included with the installation instructions.