https://en.wikipedia.org/wiki/Web_of_trust
http://www.pgpi.org/doc/pgpintro/
http://www.rubin.ch/pgp/weboftrust.en.html
Essentially: with cryptography, you aren't concerned about the transport, you're concerned about the crypto.
Signatures of the source or binaries will tell you if they've been changed.
Signatures on keys will tell you who trusts those keys. If someone you trust trusts a key, then you have a transitive trust of a key. This does mean, though, trusting people not to sign bogus keys.
In TLS/SSL, you have a hierarchical trust. Your session (and its contents) are encrypted and authenticated by the host key, which is signed by the CA's key. The theory is that we can trust CAs. Practice shows otherwise.
It's not cryptographically viable to fake a signature (of a key or data), though if someone manages to lose control of their private key, that's possible. PGP/GPG doesn't handle expired keys well.
But the upshot is that HTTP transport of PuTTY is fine from an integrity standpoint, so long as you verify the binary and signatures. And if you don't mind others being able to see what you're fetching as you're fetching it (the only real benefit to HTTPS in this case).
Even an MITM rewrite of data isn't a critical issue since you can catch that in PGP validation.