Comment by mpeg

Https only guarantees the origin and protects against MITM, they provide a GPG signing key and sign their isos so it does all that + guarantees that even if their websote gets compromised attackers wouldn't be able to distribute software unless they obtained the private key.