Comment by roddux

But if the file and site are both accessed over HTTP, it's possible for a bad actor to alter the file and then change the signatures+checksums listed on the page to reflect it.