serving ELPA over HTTP/S

[Ted Zlatanov]

What would it take to switch the GNU ELPA to HTTP/S?  It's already
accessible that way at https://elpa.gnu.org and all the web pages are
consistent.  I can think of the following:

* set the defaults and docs to point to https://elpa.gnu.org

admin/notes/elpa:the content visible at http://elpa.gnu.org/packages.
doc/lispref/package.texi:the archive hosted by the GNU project at 
@url{http://elpa.gnu.org}.  This
etc/NEWS.24:from a package repository at http://elpa.gnu.org.
etc/ORG-NEWS:available through http://elpa.gnu.org) and the =org-plus*.tar= 
package (the
lisp/emacs-lisp/package.el:(defcustom package-archives '(("gnu" . 
"http://elpa.gnu.org/packages/";))
doc/emacs/trouble.texi:or in Gnu ELPA (@url{https://elpa.gnu.org/}).

* warn and possibly abort when ELPA transfers are done over HTTP
* offer to switch the "gnu" ELPA archive to https://elpa.gnu.org
* test on all platforms
* maybe add the GNU ELPA SSL certificate chain explicitly to Emacs

Ted