In case you didn't read, yes I said they were GPG signed. But they don't make that info available (or linked) on the main download page, you have to google to find it.

SSL 3 is still fine for protecting integrity, just not confidentiality, so it is okay for downloads.