The point is, if you don't verify ssl certificates, you might as well use http. Https with self signed certs provides you no security in any circumstances downloading public software.

Self-signed certificates and http connections are trivially intercepted and forged (ever used wifi in a public place?)

Signed certificates provide limited proof of identity true, but they can't be forged by jokers hijacking the wifi in a coffee shop.