I made it 10 lines into the very first plugin before hitting a point where the installer script is downloading a file over an insecure connection, and treating it as a list of trusted URLs.