I guess CTAN did that because browsers tend to annoy you more and more
if you use plain HTTP, and I blindly guess that some CTAN browsing
experience became broken at some point
Exactly. (Not just "CTAN" browsing.)
None of this is about actual security. It's about placating stupid
browser behavior. But we have to live with it. -k