Hacker News Reader

That would help, but an attacker being able to deliver an arbitrary website by MITM is still something that should be avoided.

Signing the update file and having a separate page for the SHA256 hash of the binary would win back a lot of my confidence at this point.