title: Can I use http for my customers to download signed installation files?
body: <p>I am planning to host a clickonce application in a web server and want to give access over http (NOT httpS). The application is signed with a certificate. I assume that this should be OK not to use https because man-in-the-middle attacks cannot spoof the singed binaries. I've following questions regarding this.</p>
  
  <ol>
  <li>Are there any other security threats that I should be aware of?</li>
  <li>Does using http over https increase perceivable performance (assume there are many clients downloading the setup files from server. There should be less overhead on server with plain http)</li>
  </ol>
  
  <p>thanks.</p>