Is it possible to change this to https to prevent MITM attacks during install/upgrade?

Also, is there a way of using GPG or something to verify that the software being automatically downloaded is the same code tested by the person who last updated the Gemfile or Gemfile.lock?  I'm not keen on automatically installing gobs of third-party software which, if any one part is compromised, could compromise my development environment.