And, of course their site is HTTP only, including the path for their PGP signing key (!!!). They do have a valid Let's Encrypt cert, but apparently it's only c

And, of course their site is HTTP only, including the path for their PGP signing key (!!!). They do have a valid Let's Encrypt cert, but apparently it's only configured for the `download` subdomain.