That can happen regardless of HTTP&#x2F;HTTPS, say if the site was hacked they could be serving a bad key&#x2F;signature, which is why you should always obtain the public GPG key (in any scenario, really) via a trusted channel, or multiple ones.<p>So for instance in this case you could grab the gpg key, go into their IRC channel and ask for it again, etc.<p>I do agree HTTP makes it easier to MITM, but in theory if you are serious about security you should not be relying on HTTPS alone.