They serve the hash over https, so they are better than most: the provenance of the download is verifiable assuming that the server serving the hash hasn't been

They serve the hash over https, so they are better than most: the provenance of the download is verifiable assuming that the server serving the hash hasn't been compromised. Whether a GPG signature would be better depends on whether the user has a meaningful way (other than https!) of gaining confidence of the key being the genuine key. The response from the person claiming on rasp pi is more worrying than the situation being complained about, though.