This requires custom knowledge. If an attacker swaps out the page and serves the links from some other unusual site (or even the.earht.li), who is going to noti

This requires custom knowledge. If an attacker swaps out the page and serves the links from some other unusual site (or even the.earht.li), who is going to notice? Only old-school people with that custom knowledge who also check the source of the download link. I find it bizarre that the server is managed by the guy who wrote dpkg (which involves GPG), yet still doesn't have https on it...