Which as far as I can tell is what Marlinspike meant by harm reduction. It's not preventing anyone from hijacking your encrypted session and serving you a bad

Which as far as I can tell is what Marlinspike meant by harm reduction. It's not preventing anyone from hijacking your encrypted session and serving you a bad app, I'm not sure how it could. ("How do you secure your connection given that your security has already been silently compromised?" isn't a question I really understand.) But it helps ensure that people are at least requesting the genuine app, and if they get it then they'll get signature verification for future versions.