That can happen regardless of HTTP/HTTPS, say if the site was hacked they could be serving a bad key/signature, which is why you should always obtain the public GPG key (in any scenario, really) via a trusted channel, or multiple ones.
So for instance in this case you could grab the gpg key, go into their IRC channel and ask for it again, etc.
I do agree HTTP makes it easier to MITM, but in theory if you are serious about security you should not be relying on HTTPS alone.
So for instance in this case you could grab the gpg key, go into their IRC channel and ask for it again, etc.
I do agree HTTP makes it easier to MITM, but in theory if you are serious about security you should not be relying on HTTPS alone.