Is there a description somewhere for how they're handling the security of secret keys on their end?

Also, it looks like the libraries are only offered as tarballs and are being served over HTTP?