fritzophrenic - 2016-03-04

I think "some users would prefer to connect securely" is understated. It is not very safe to download plugins or installers over plain http (or FTP), because they may have been tampered with. I'd certainly feel more comfortable if I could download from an https page (although I build my own Vim these days, and get most of my plugins from their source repository, so that's less of an issue for me).

Equally bad, the login form for plugin authors is not encrypted, so it would be easy to sniff their username and password. And the lack of a basic feature like HTTPS does not give "warm fuzzy feelings" for the password storage on the back-end. So it may be easy for an attacker to upload malicious scripts in the name of a respected plugin author.

Signing installers might mitigate the potential for modified installers, but it won't help with the plugins, so a secure download option and secure login should be supported.