I can't be sure, but: - It's possible to deliver SSL without putting the keys on boxes; of course there's a need for a network connection to the servers holding keys. It's a tech pioneered by cloudflare, can't rememeber the name. - or, there's no SSL for the content, which is signed otherwise (like ubuntu or debian repos).