They are using TLS to assume that the client authenticates the server is who it says it is -- if you can man in the middle TLS, there are lots of other possible exploits besides this signature one.
One of the things that's neat about, say, OAuth's MAC authentication, is that it works over plain old HTTP without TLS. Likewise for the AWS API's signature-based security scheme. Sounds like I erroneously assumed that this was aiming to do similarly.