An attacker wouldn't MITM your download, they would take control over your mirror and serve bad copies. Hence the signatures. SSL secured downloads would be pr

An attacker wouldn't MITM your download, they would take control over your mirror and serve bad copies. Hence the signatures. SSL secured downloads would be pretty much snake oil for ensuring file integrity end-to-end. You will find the same practice pretty much everywhere among the larger projects.