The Bitcoin client is downloaded from a non-HTTPS server, so you cannot verify that it is legit, and the installer exe is not digitally signed. How often does that result in a Trojan client, and why is it done in this way?
I understand that you should check the pgp signature of the file, but if you do not have https, then how do you know the pgp signature is not just as bogus as the file itself? Don't we need https too?