What if an exploit is found in the signed copy? Someone else can host the old version which is still signed and supply it to the user. Are they going to revoke the certificate used to sign it entirely?! Not using HTTPS is a sloppy security practice on their side.

Linux packages are signed and commonly served over HTTP by various mirrors. How is this any different?

Ideally, you'd want them to use HTTPS to deliver the packages as well. However, I cut free software distribution some slack, because of massive distributed mirroring and delivery by a number of third parties. For Microsoft, it would be easy: why _not_ use HTTPS and get another line of defense?

(update: revelation's comment is insightful; just saw it. I forgot about versioning.)

They are versioned, of course. You will have to explicitly agree to a downgrade.