Plugin ZIPs are downloaded from URLs like http://moodle.org/plugins/download.php/1292/mod_stampcoll_moodle23_2012062201.zip

Proper SSL certificate for this site is requested so that we can fetch the ZIPs via HTTPS. This should help to protect against the man-in-the-middle attack via injected plugins.

Changing the download URL later is doable as it is being distributed as a part of Available updates notification machinery.