I guess you could download it from the Jenkins job��
https://ci.inria.fr/pharo/job/Pharo-5.0-Update-Step-5-Publish/lastSuccessfulBuild/artifact/
although the job itself downloads over http from
files.pharo.org��� but Jenkins should be fine enough if you are worried about MitM between you and Pharo.
For SHA you still need a secure connection assuming the website wouldn't get compromised,
or digitally signed releases assuming the signing won't be misconfigured, or the keys won't get compromised.
But I agree that this should be solved, or at least improved; but then again whole smalltalkhub doesn't use https and you are sending your credentials in plaintext over the network (have fun committing from a hotel room wifi)��� security through obscurity can be incredibly efficient.
Of course that means that we need someone with the time and knowledge that can invest effort into this.
Peter