Https only guarantees the origin and protects against MITM, they provide a GPG signing key and sign their isos so it does all that + guarantees that even if their websote gets compromised attackers wouldn&#x27;t be able to distribute software unless they obtained the private key.