Indeed, then we would skip checking the hashes because timestamp would have no signed hashes for itself, right?

So, @vladdd and I discussed this, and we think a problem here is that we are using the same download function to do different things in different cases (either do or skip safety checks). I think you would agree with us that this is a bad idea because it would hide programming mistakes. We think we should split the download function into two different ones: one that must do the safety checks and one that must not. We would call them by clearly marked names, so that we can be sure that we are doing the unsafe thing in very limited cases that can be easily discovered from the code.

What does this mean? It means that we still have some work ahead of us to make the whole download process safer, so I will push your changes to a separate branch. We will continue our work from that branch.