If the original website is insecure, everything could be faked, including the link to the releases page.
If HN readers don't understand this, who does?