I noticed that the downloads for LibreELEC use a non-https connection. Would it be possible to update the links to https? It appears https works, just the links don't use it.
I noticed this came up once a couple of years ago (Security issue with download). That thread suggested that a server upgrade needed to happen first.