If you get the signature from the same place you found the download link (or a place that may be controlled by the same entity), that seems precisely as good as HTTPS.