jhourcle has addressed this for his type of data with an https side channel for checksums of files available for download. See the response to the comments (als

jhourcle has addressed this for his type of data with an https side channel for checksums of files available for download. See the response to the comments (also explains why rsync is not appropriate in their system for a specific class of file). jhourcle is not against https, but he/she wants the ability to use http where an exception is needed. The cost of the certificate is negligible, but the ability to keep a fragmented, heterogeneous (age wise) environment is part and parcel of the job, and NO additional funding is being provided to accomplish or operate this under https. From reading the original and the response to other comments, it is apparent to me that jhourcle has thought this through and is only asking for an exception process that they can file for. Just as they do today for systems that are not in compliance (not related to https) for various reasons (ref: comment response).