use https urls instead to avoid a need for public/private keys