A critical security update for Adobe Acrobat Pro and Standard 9 on Mac OSX is only available over HTTP, and is unsigned code. Is there any out-of-band way to verify the download is authentically from Adobe?
You're right. If you go to Adobe's website the update is transferred over HTTP and not HTTPS, which give any hacker in the network to hijack your update file with a simple Man In The Middle Attack and inject his/her malicious file instead of the legitimate Adobe's update.
However if you go to the same page and instead of clicking the download now button you copy the link and add HTTPS as a prefix to it. The file will transferred securely over HTTPS.
here is the direct link: https://ardownload.adobe.com/pub/adobe/reader/mac/11.x/11.0.06/misc/AdbeRdrUpd11006.dmg