While I haven't looked at the code and can't tell you if it's the case here, most package managers I've used use unencrypted http for the traffic.

Security is achieved by verifying the signature of the downloaded file.

An additional benefit is that you can easily put a http proxy in front of it.