There are other threat vectors you aren't considering such as DNS cache poisoning, [BGP hijacking][1], and [rogue USB sticks][2]. But even ignoring that, why w

There are other threat vectors you aren't considering such as DNS cache poisoning, [BGP hijacking][1], and [rogue USB sticks][2]. But even ignoring that, why wouldn't you want to take basic steps to protect against rogue access points or ISPs? "I don't particularly care if people get MITM'ed when visiting my static sites" seems, at least to me, like a rather dismissive attitude towards the security of your site's users. I'd also like to point out that with the ever-widening deployment of HTTPS the hypothetical attack you described where your ISP MITMS your browser install is becoming less and less feasible. Nearly all modern browsers include a [HSTS preload list][3] which ensures they will never attempt to connect to certain domains over an insecure connection. A browser download site (or even just the user's search engine, which would link directly to the HTTPS-protected download page) being on this list would make the downgrade attack you describe much more difficult. [1]: https://www.internetsociety.org/blog/2018/04/amazons-route-53-bgp-hijack/ https://www.internetsociety.org/blog/2018/04/amazons-route-5... [2]: https://samy.pl/poisontap/ https://samy.pl/poisontap/ [3]: https://scotthelme.co.uk/hsts-preloading/ https://scotthelme.co.uk/hsts-preloading/