Plain HTTP is so much better for downloading public stuff while being behind these crappy corporate HTTPS firewalls.
You then just verify the files with the GPG tools.
This. In my limited experience, HTTP MITM doesn't really happen. I'm sure TLS is quite fast on reasonably modern magic rocks, but for things like distribution ISOs I prefer to download only checksums over HTTPS.