[mattdm]

Note that Fedora distributes metalinks to mirrorlists via https, and the main mirror at https://dl.fedoraproject.org/pub/ also uses https. We don't mandate that for our (volunteer!) mirror network, but many mirrors _are_ https. (See https://admin.fedoraproject.org/mirrormanager/mirrors/Fedora... for the current list.)