Putty supports hmac-sha1, which is more than fine.

Unfortunately PuTTY still isn't served over https, even after all these years. If you're concerned about esoteric MITM attacks, this is worth remembering...

Considering that PuTTY has GPG signatures, there is no need for downloading it over HTTPS. Of course, this does leave the issue of how to obtain and confirm the right GPG key for verifying the download.

Unfortunately PuTTY still isn't served over https, even after all these years...