Download toolchain through HTTPS for authenticity and privacy (fixes #48)