@rfugger:

If you're worried about the MD5 and therefore the application being tampered with, an SSL tunnel from a hacked server is not going to get you very far.  Use PGP.