To answer your question, yes. If you were the victim of a MITM attack, the attacker could easily modify anything on the page before it gets to your browser including links to the signing key, iso files, and the key fingerprint.
That being said, there is a way you can verify the identity of a website if it uses an EV (Extended Validation) SSL certificate. If you use either Firefox or Chrome to view the site and you see the special EV treatment in the address bar, you can be confident that the site hasn't been tampered with in transit.
(I tried to include images of "EV Treatment" in Chrome and Firefox but apparently Stack Exchange counts images as additional links and I need "at least 10 reputation to post more than 2 links")
Internet Explorer also shows this special EV treatment but Microsoft deliberately allows EV indications to be forged.
For a more in depth explanation of why EV certificates are "spoof proof" checkout this article by Gibson Research Corporation.
GRC also provides a way to verify sites with non-EV certificates by comparing a site's "certificate fingerprint" with one obtained by GRC's fingerprints page. Of course relying on that tool implies some level of trust in GRC. Namely that they aren't responsible for, nor in support of a MITM attack against you.
Let's assume for a moment that GRC were victim to a MITM attack themselves. The attacker could theoretically return the same bogus certificate to GRC that they displayed to you. While this would only be possible for a global actor to accomplish it doesn't really matter because GRC uses an EV certificate so if they were victim to a MITM attack, you could detect it before using their fingerprint tool.