It seems Safari mistakenly downloads the file as a .dmg.bz2 file, rather than just a .dmg file.
This means that when you try to open it, the contents get hashed up by the unpacking process.
If you simply rename a Safari download to .dmg before opening, it opens fine.
The possibility is that the server the file has been hosted on, is configured to identify .dmg files as .bz2 in the MIME information. This would cause Safari to dutifully mark the file with the .bz2 file extension.