[qbasic_forever]

Realistically a poisoned ARP or DNS attack that redirects your machine's traffic to the attacker's server, both for the download and the download page, is something to be concerned about. This only requires someone to have access to your local network, not to your machine. It could be as innocent as working at a coffee shop from their wifi network and an attacker being on it too...

[moondev]

curl validates the TLS certificate by default, it will fail in your scenario unless you pass -k. dev TLD requires https on all connections