The download is not over HTTPS, so you also have to trust the network. Also, the package you're downloading is not signed (which it would be if it came from a software repository, which almost all major operating systems have) so you have to trust whoever runs that website.