Crossrider assets downloaded over SSL?

Edit Subject

We've been asked to confirm whether a Crossrider extension's assets (in particular the Javascript files, but really everything) are downloaed via SSL or not? An initial probe seemed to indicate not, that they are downloaded via plaintext (http not https). Can you please confirm? And if they are downloaded over http, is there anything we can do or is there a roadmap item to serve them via https?