Hacker News Reader

What's to stop someone in the middle changing the checksum on the page?

The download page could still be served via HTTPS, even if the download itself isn't.

The checksum is normally gpg signed.