[Security Issue] Invalid HTTPS certificate, models served from http:// URL

Prerequisites

Please answer the following question for yourself before submitting an issue.

• [ Yes ] I checked to make sure that this issue has not been filed already.

1. The entire URL of the documentation with the issue

https://github.com/tensorflow/models/blob/master/research/object_detection/g3doc/tf2_detection_zoo.md

(Probably elsewhere, too)

2. Describe the issue

The models are served via http. Since this protocol has no security, a man-in-the-middle attacker could serve their own model instead. According to https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md one should never run untrusted models.

3. Solution and new issue

In theory, the fix should be as simple as replacing http with https. Unfortunately, the server hosting those models is not configured correctly. As far as I can tell, the domain download.tensorflow.org is missing from the HTTPS certificate.

4. Another improvement

The first step would be to serve those models over HTTPS protocol, but it would also be nice if e.g. SHA-256 hashes were linked directly on the README page. They obviously can not replace HTTPS since most people probably will not take the time to check the model hashes, but they would serve as an additional layer of security for those who care. The hashes might already be somewhere in this repository, but if they are, they are too hard to find.