I think a warning with HTTP would def be good. --find-links requires user actions to enable it so we'll be secure out of the box still. The biggest concern I have with tying it to --allow-no-ssl is losing PyPI SSL protection b/c one of your find links doesn't have a valid SSL cert.