This is bad advice. The linked document seems to be interspersed with misconceptions. It is important to remember that downloading your software over an encrypt

This is bad advice. The linked document seems to be interspersed with misconceptions. It is important to remember that downloading your software over an encrypted link does nothing to ensure the integrity of the software. Please note that the complete infrastructure of all the big Linux distributions (Red Hat, Debian, etc.) is all served over plaintext only. This is for a very good reason, and you must understand these reasons before making suggestions on software distribution schemes. Software should be verified using PGP signatures. These signatures should be distributed with the software. Keys are published on keyservers and signed through the web of trust (easiest done by attending any open source conference). There must be no trust placed in distribution archives and mirrors. If software integrity was entrusted to the transport layer, any employee of sourceforge, github or any one of the hundreds of mirrors out there could backdoor anything. There is also strength in numbers with the distribution method. If every little package had their own way to check integrity, it would be easy to fool the casual user to use a less secure method by controlling the distribution point.