HTTPS does not solve the problem if the server operator adds malicious software; it only prevents spies from doing so. Cryptographic hashes can help if the use

HTTPS does not solve the problem if the server operator adds malicious software; it only prevents spies from doing so. Cryptographic hashes can help if the user who downloads the files knows the hash ahead of time somehow, although there can be a difficulty in figuring them out. Getting the checksums out of band like you suggest is a possibility, and might be suitable if the file cannot easily be transfered directly. (It could also perhaps be communicated by other people by writing down, by voice on telephone, etc; if they (and the communication in use) can be trusted.)