The download page could still be served via HTTPS, even if the download itself isn't.