Comment by blub

Gimp and Inkscape are the only free or open source graphics tools that have something resembling a secure download process.

Krita serves their website over https and the download over http from some mirror. Can't find any trace of a hash on their site either.