The issue is not the lack of SSL but to not sign and verify the images. If they want to use mirrors to distribute the binaries it's a far better solution.

You still need to securely fetch the signatures somehow initially. Similarly, http://download.cyanogenmod.org/ provides md5 hashes for downloads but because it's not done over HTTPS you've got no guarantee that you're getting the right hash to verify the insecure download.

Actually if you just google the MD5 and it shows up in google should work as a guarantee

(Example: https://www.google.com/search?q=b13afc01102c84425ca995469f1a...)

Unless the download page is hacked and Google picks up a spoofed checksum.

They need to sign their updates as well.

Yeah, and Linux is compromised if someone kidnaps Linus Torvalds family in exchange for creating a backdoor in the Linux kernel.

The security is created by humans to be used by humans; so nothing is truly safe if <insert random circumstance> happens; and anyway, for cases like yours the hack would be found after few days when any of the people in charge of the compiling realizes that the check-sum is spoofed and would advice anyone to update the OS after the issues is taken care of.

Unless the malware is spread by Google.

... or, more likely, the MITM is capable of spoofing selected google searches as well.

You know Google always uses ssl right?

There are people in the world capable of spoofing SSL one way or another (forged certs, suborned CAs, etc.), though it certainly does raise the bar past the script kiddie level.

You just need to have the public-key on the device already and then verify a cryptographic signature (not just a hash) of the zip.

Looks like CM have a https version of the download page now.

Yep, even better.