The example from their documentation did not play <audio src="soundbank://soundlibrary/transportation/amzn_sfx_car_accelerate_01" />. So we cannot simply insert the audio tag.
I assume github hosted files would be safe to use.
Let's Encrypt SSL Certificates are provided by the "Internet Safety Research Group". Amazon uses Mozilla's trusted Certificate Authorities list, which includes the ISRG. So, files hosted on my domain should be safe.
https://github.com/custom-components/alexa_media_player/wiki#play-sounds-versions--240