It uses fairly standard HTTPS for update checking (endpoints). I'm planning to write a detailed blog post on how it works technically so hopefully that will answer your questions.

Completely self-hosted solutions aren't currently planned.