Web site download HTTPS and SHA1/MD5sum

Hi, we had two observations from a user on both CE and EE downloads:
1) Downloads are not served over HTTPS, even though the rest of the page is. Can this be fixed?
2) Can you post SHA1 and/or MD5SUM for the CE and EE downloads on the web site, especially since they're not served over SSL?
Thanks!