This question already has an answer here:
Most major Linux distributions, such as Debian, Ubuntu, and Centos, serve their ISO files over unencrypted HTTP or FTP. They don't even provide an option to download using TLS, even when the rest of their website uses it. At least some distributions, such as Ubuntu, also use unencrypted HTTP to serve the GPG key files that people are supposed to use to check the ISOs after downloading.
This seems like a huge security risk, because an attacker could easily substitute their own compromised ISO files for the real ones, and the same thing for GPG keys.
I'm sure the Linux distributions know about this, so they must not think it's a problem. Why not? Is there some workaround for users to ensure that the files they download are legitimate?