This is not what "separate channels" means.
Separate channels refer to different ways of communication. By using Tor instead of directly connecting to the server, you still communicate via HTTP with the webserver in the backend and ask it to deliver a file to you.
Imagine if the file you are trying to download was modified by an attacker with access to the webserver. They could easily create their own signing key and sign the malicious file with the forged key. If you have no way of verifying the key with the author, or by using the "Web of Trust" approach of PGP, then you would not detect the forged key, since they key you received and they key the webserver displays are identical.
So what does "separate channels" mean?
A separate channel is any channel of communication where compromise of one thing would not affect the other. For example, a letter sent via the post can be intercepted, but it would not affect what is sent via HTTP or spoken via a phone call. All of these are separate channels, and they can be used to verify they validity of a key.
For example, if you had downloaded a malicious file and a forged key, then called the maintainers and asked if the key was correct, you would have seen the key was forged and the attack would likely have been identified. This is impractical in person, because nobody aside from people trying to prove a point would call up the maintainers of a project to ask for the thumbprint of their signing key.
How can I verify this in practice?
In practice, this becomes a bit more difficult. One way to do this is to obtain the key from a different source. By spreading the public key as much as possible, the attacker can never be sure if people would download the (forged) key from the compromised web server or a different source, which was not compromised.
