I understand you're working fast and it's early.

But not providing hashes and using a two stage downloader and not using ssl and using auto updates and not using code signing means that your app will now be the weakest link in terms of security for all but the worst configured computers.

While it's almost certain no one is targeting you or your users now, that could change when people see such a weakness or could leave people open to local attackers that you'll never have a chance to notice.