I find it weird that a company providing a security/privacy tool isn't even using https on the website and providing a checksum for the binary.