When you download a git-annex package from downloads.kitenet.net, as listed in a page under install, you should use a https connection. That provides some security, but here's some more.

The downloaded package's integrity can be verified by checking that it was signed using the right GPG key, specifically the git-annex distribution signing key. To do this, you need to download the .sig file accompanying your package. Just append .sig to the url.

For example, on Linux:

$ wget https://downloads.kitenet.net/git-annex/linux/current/git-annex-standalone-amd64.tar.gz
$ wget https://downloads.kitenet.net/git-annex/linux/current/git-annex-standalone-amd64.tar.gz.sig

You can then download the public key, and check that the package is signed with it.

$ wget https://downloads.kitenet.net/git-annex/gpg-pubkey.asc
$ gpg --import gpg-pubkey.asc
$ gpg --verify git-annex-standalone-*.tar.gz.sig

(The git-annex assistant can automatically upgrade git-annex, and when it does, it always checks the signature like that.)

But, how do you know that the gpg-pubkey.asc you downloaded is the right key? The answer is the GPG web of trust.

• Joey Hess generates these git-annex packages, and has a GPG key, C910D9222512E3C7 Joey Hess <id@joeyh.name>, which has been verified and signed by many people.
• Joey's GPG key has signed the git-annex distribution signing key.

Don't take this page's word about this, check it yourself!