Hacker News Reader

Shouldn't you be using HTTPS for all downloads and grabbing the sha1s and image from different mirrors?

That is a good idea but note the use of GPG - if you aren't able to forge that signature, the verification step will fail.

Right, I missed that.

Great idea.