[dignan]

Just to follow up on this, what checksums do offer is a way to verify that the file you have locally matches the remote file.

[testing12341234]

Checksums do not offer this property if both the remote file and checksum are both sent unsecured. If an attacker can MitM the remote file, then they can also do the same for the checksum file.