If an attacker manages to MITM your initial browser installation or upgrade download then we're in trouble. We'd then have to resort to verifying the authentici

If an attacker manages to MITM your initial browser installation or upgrade download then we're in trouble. We'd then have to resort to verifying the authenticity of our browser install file through some other means. You could use HTTPS for your download though you'd need to be sure that you've done this every time and the original copy was from a trusted source. No doubt this is why open source developers are so keen to exchange GPG keys when they meet in person. Though at least when you're using some public wifi AP, you're unlikely to be upgrading your browser.