It is always verify disk images before using.
In Ubuntu's website, many pages are sent through https. However, some of the most crucial pages are not. For example, http://releases.ubuntu.com/trusty/.
This is clearly vulnerable to mitm and tons of other attacks. Although most of them are debunked, there has been lots of myth of backdoors in Ubuntu. I fear that this is a sign of government bugging the image files, or backdooring the software.
Is there any reason for Canonical/Ubuntu site maintainers to disable https at none but the checksums pages?