> Emacs doesn't allow packages to be installed over HTTP

Are you sure about that? I think that you can specify http as usual in the URL:

  (add-to-list 'package-archives '("melpa" . "http://melpa.org/packages/") t)

See the instructions here which go to an annoyingly extreme level of ugliness to set the protocol in a paranoid fashion: https://melpa.org/#/getting-started