use https to download the gpg public key

I hope this doesn't need the CLA...