Um. You can't forge signed checksums unless you have their private key...

You're supposed to check the signature with the key you got "out of band". That means good security practice. Even if you get the key from a SSL/TLS enabled site, you can't guarantee it's the right one, CAs can be compromised. The checksum is to let you check if the download is corrupted and the signature is to check against the key you already have. Other forms of checking are just false sense of security.

An attacker wouldn't MITM your download, they would take control over your mirror and serve bad copies. Hence the signatures.

SSL secured downloads would be pretty much snake oil for ensuring file integrity end-to-end. You will find the same practice pretty much everywhere among the larger projects.

Then there's also this: http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man1/...