Not as alarming as it might look at first glance: data is unencrypted but apparently signed.<p>This is essentially the same way that most Linux distros update: the data is not protected in transit (although with modern SSL being cheap both on servers and money, it ought to be), but integrity is preserved (assuming a trusted key distribution channel plus assuming the signatures are checked before install, and an update would only install with a valid signature).