A fairly dramatic example of this sort of problem: http://www.ubuntu.com/download is not HTTPS. The page with the hashes is, though. https://help.ubuntu.com/community/UbuntuHashes