[mtpettyp]

And even if this endpoint (defined in the WSDL) was changed to to https there is nothing stopping you from overriding it and pointing it to any other (possibly unsecure) URL.