Must we download binaries via http to update iRedMail?

Hi,

I was updating iRedMail to the new version, but I noticed the upgrade tutorial tells me to download iRedAPD from http://www.iredmail.org/yum/misc/ which uses no https, and provides no checksum to validate that my download is what I expect.

Is that not a security concern?

Thanks