Without ssl, someone could hypothetically intercept it, modify the instructions slightly, and lead you to installing something malicious. They could also do other things like inject javascript, etc.

1. Replace "company" with "website".

2. It's the standard moving forward.