updates: use HTTPS for fetching update payloads