Oh, that's a security issue then. It means that an attacker can still MITM by having a non-SSL HTTP proxy server on port 443.

The opener used by pip to access PyPI (and all https URLs) should *only* allow SSL connections; there should not be any fallback to HTTP (not even if SSL fails).