In this case, you have no idea if the connection is MITM'd because of http. You must assume the source untrustworthy, because you don't know who it is. Additionally, assuming the page's source (from which you copy this command) is over http, you must assume the website has compromised (e.g.) your clipboard on copy and you're pasting in malicious unicode characters or whatever. People should have an inherent distrust of binary blobs, too, for whatever that's worth. Same caveats over serving the download over http, with the added benefit of not being able to read the source (necessarily), with the added bonus of now having to assume the build machine has not been compromised.