But if the file and site are both accessed over HTTP, it's possible for a bad actor to alter the file and then change the signatures+checksums listed on the page to reflect it.
So for instance in this case you could grab the gpg key, go into their IRC channel and ask for it again, etc.
I do agree HTTP makes it easier to MITM, but in theory if you are serious about security you should not be relying on HTTPS alone.
On those types of networks, MITM attacks are extremely easy, and there are tools to do it in seconds. It may be more likely for you to get MITM'd and have them modify the signature, than for the actual website to get hacked. Combined with the fact that some people would try to download Tails across these types of network for the added anonymity.