This avoids issues with the user's certificate store by skipping
TLS. That means that middlemen will know you're asking for the shell
zip, but they'd probably be able to guess something similar from the
size of the response payload anyway. All of our other fetches are
already over HTTP, and we don't have to worry about verifying the
server because we have cryptographically-strong hashes for verifying
the file they sent us.
This avoids issues with the user's certificate store by skipping TLS. That means that middlemen will know you're asking for the shell zip, but they'd probably be able to guess something similar from the size of the response payload anyway. All of our other fetches are already over HTTP, and we don't have to worry about verifying the server because we have cryptographically-strong hashes for verifying the file they sent us.
Fixes #41.