When you download OnionShare from this website you‘re downloading over HTTPS, but it‘s still possible that an attacker with access to a browser-trusted certificate authority (such as a government) could perform a man-in-the-middle attack against you, swapping out the file you thought you downloaded with malware.

To be completely sure that the download was not tampered with, you can verify the cryptographic PGP signature of the file you downloaded.