Evernote checks for update over unencrypted HTTP, and the update packages are also downloaded over HTTP. But it’s signed code, right? What could go wrong? It’s trivially easy to perform a...