>putty from www.putty.org (again, no https, which is not even the actual site, but nevertheless the first result from Google)

Doesn't matter on windows. The binaries are authenticode signed.