When original public-keys/signed-codes are shown in original dev's or author's own web server or key server, over encrypted connection or encrypted webpage, then any other files, data or content can be transferred over any type of non-encrypted connection, like: HTTP/FTP etc from any sub-domain server or from any mirror or from any shared cloud/hosting servers, because, non-encrypted connection based downloaded items/data/files can be authenticated later, by using the original public-keys/signed-codes, which were obtained from the original author's/developer's own server over secured, encrypted, and trusted (aka, verified) connection/channels.