Why are plugins downloaded via HTTP instead of HTTPS? How can I change that?

I am trying to update the LoginLdap plugin, but the requests always time out. I get the following error message:

Failed to download plugin from http://plugins.matomo.org/api/2.0/plugins/LoginLdap/download/4.7.3?coreVersion=4.14.1: curl_exec: Operation timed out after 60001 milliseconds with 0 bytes received. Hostname requested was: plugins.matomo.org

I think this is because our firewall blocks these requests. As one can see in the URL, HTTPS is not used! Downloading plugin code over a non-secure connection seems unsafe. Why is Matomo not using HTTPS? Can I change it and how?