> 124 days to get AMD to add an s to a couple of HTTP URLs!

I disagree that they should only add HTTPS and call it done. They should also add some kind of signing check before running the payload.

If anything I'd say HTTPS is optional if they do that part.