I'm trying to securely validate the hash of a downloaded ubuntu-11.04-alternate-amd64.iso but it seems I just can't find any.
I found this site: https://help.ubuntu.com/community/UbuntuHashes
but there are only MD5SUMs on it.
About MD5's security: https://secure.wikimedia.org/wikipedia/en/wiki/MD5#Security
Where are the SHA256 hashes of Ubuntu images?
http://releases.ubuntu.com/11.04/SHA256SUMS is not a solution, because it's not using valid HTTPS.
Verifying the SHA256SUMS with GPG isn't the solution either, because not everyone has the public key, so we have to import it with:
gpg --keyserver hkp://keyserver.ubuntu.com --recv-keys 0xFBB75451
and I think using this method could be compromised (when importing the keys).