The signature works fine over HTTP/FTP because it needs to be combined with a public key you already have (e.g. a distro package manager will already have the p

The signature works fine over HTTP/FTP because it needs to be combined with a public key you already have (e.g. a distro package manager will already have the public key for all the packages), or a public key you will go get from a different source, e.g. https://sks-keyservers.net https://sks-keyservers.net, and it's hard for a middle-man to compromise both.