If you're not planning to add https, could you provide a md5 or sha1 hash for the files?

The certificate for steamreview.org seems to be for a different server.
I don't feel super comfortable downloading anything from a server that can't be verified.