Subject: Shouldn't the default package archive use HTTPS?

From: Steven Stewart-Gallus <[email-masked]>
Date: Tue, 29 Jul 2014 04:10:44 +0000 (GMT)

Hello,

By default (in version 24.3.50.3) the value of package-archives is (quote
(("gnu" . "http://elpa.gnu.org/packages/"))). Setting it to use HTTPS seems to
work fine. I think it should be the default. Am I missing that Emacs has some
other way of authenticating downloads and so HTTPS is not needed?

Thank you,
Steven Stewart-Gallus