HTTPS

Switch to https.
Include the Startcom root CA (https://www.startssl.com/certs/ca.pem) in res/.

At startup, replace the default SSL socket factory with one that trusts StartSSL in addition to the system's other CA's. Based on http://stackoverflow.com/a/16229909/218269

The code is awfully complex. Also, this contains fairly large code blobs from Stackoverflow with no license info, not sure if it's a problem.