Many developers distribute software over a HTTPS connection and recommend that their users verify the integrity of the executable by comparing a hash or PGP signature. Both the executable and the hash are served over HTTPS from the same domain. What possible benefit could one achieve by verifying the executable? If an attacker has been able to replace the installer, surely they can also replace the hash displayed on the webpage, since both are served from the same domain.
I've seen this with a bunch of installers, but I'll pick Whonix as an example. They go as far as declaring downloads without verification as having "medium" security and downloads with verification as having "high" security. There is a reference link behind the claim, but the link is broken so I don't know what the explanation would have been.