Please, don't spread unfounded fear.
> Trisquel page is available over HTTPS, yet The download itself is over
plain HTTP
Like any other download server, with reason. HTTPS is implemented to the data
transferred from and to a web server, which for a public software repository
is not needed nor recommend, and it does not provide file verification
anyway.
> MD5 is completely useless if you don't get it from a trusted source.
The MD5 file is GPG signed.
> GPG signature is only useful if you have already gotten the public key to
verify it against, again from a trusted source.
We sign our sources, binaries, images and repositories with a GPG key that is
publicly accessible, e.g. in each of our mirrors. I just signed the key
myself as a way to make it easier to validate.
