Getting ubuntu iso securely

[Rune Schjellerup Philosof]

Hi

I am puzzled by the absence of a secure method of downloading the ubuntu
iso images.
www.ubuntu.com is not served over https and neither is releases.ubuntu.com.

None of the mirrors are using https.

Isn't this a major security flaw?

I know that there are md5sum files and they are gpg signed as well. And if
you search for it you might find
https://help.ubuntu.com/community/VerifyIsoHowto.
But on www.ubuntu.com there are no instructions reminding you to verify
the download.