Yep, https. Look at the last two URLs at the very end of the file:

https://github.com/gnachman/iTerm2/blob/master/plists/releas...

Likewise, all HTTPS here:

http://iterm2.com/appcasts/testing3.xml

If you're on Mac OS 10.11, we don't disable app transport security, so the OS prevents us from making HTTP requests at all.