Well, the URL pointed by `--find-links` can still be MITM'd to serve compromised packages, as far as I can see. Obviously it's less important than fixing the PyPI one, but it's probably something to consider while we enforce pip security.

Does `--find-links` work with HTTPS urls? Maybe we should emit a warning if the URL being passed is HTTP?