I think the element that was missing from my question earlier on today was the money bit, to be honest. The web has moved on so much since the 90s when I last did any significant ftp/piping/general command line stuff. You have answered my question nicely.
My other point about displaying the web address of the download site was more one of convenience than of security, I think. I was just thinking of a big round ‘click here to download’ button.