The md5sum is for verifying that the ISO is completely and correctly downloaded, not for verifying the source of the uploader.
However, there often is another file - an asc-or pgp-file - this contain a detached pgp-signature, and can be used to verify the source of the files. The detached signature is often for the md5-file (not the ISO-file itself); but if the md5-file is genuine and it tells you the ISO-file's checksum is correct, then you have an intact chain which ensure the ISO-file is genuine too.
It doesn't really matter if the download-site for all is insecure. If either or all of the files were tampered with, that would be detected by
pgp. As long as the author's secret-key hasn't been compromised - or you haven't been mislead to verify the download with a false public-key (a key only pretending to be by the author - then you'll detect any tampering. Either because the ISO-file's checksum doesn't match, because the md5-file can't be verified, or because
gpg fails to correctly process the detached signature with the author's public-key
For example, you've downloaded
image.iso. You verify that it's correctly downloaded by finding it's md5sum and comparing it to the contents of the
image.iso.md5 file. Then you take the
image.iso.md5.asc and the public pgp-key of the uploader/programmer, and use
gpg to confirm that the
image.iso.md5 is genuine and untampered. Assuming it is, then also your ISO-file is - assuming the md5-checksum matched.