In this situation, addons.mozilla.org is the hypothetical man in the middle so https doesn't protect you.