Always prefer HTTPS and verify PGP/checksum signatures from the provider.