Not supporting HTTPS together with falsely claiming "no server involvement" when everything happens via the server makes me think this is a honeypot or something like that.
If there is no server involvement, how could there be HTTPS, which by definition requires some trust in the server?
The web page must be served from somewhere, even if the server it came from really wasn't involved in file transfers. It would be nice to have HTTPS for the client to rule out MITM attacks or the like.
The client can be sent encryption keys, generated by the server, and use them for P2P encryption, so the MITM can be avoided.
That's great if the server that sends the encryption keys is actually the server you think you're talking to.