Without ssl, someone could hypothetically intercept it, modify the instructions slightly, and lead you to installing something malicious. They could also do other things like inject javascript, etc.