Yes, that is the default. But you could connect through an https proxy or check PGP signatures (see http://blog.quicklisp.org/2017/09/something-to-try-out-quick...).