Check mirrors/download links are HTTPS

[nma]

When running mvnvm for the first time it attempted to download Maven from http://.../apache/maven/maven-3/3.5.4/binaries/apache-maven-3.5.4-bin.zip. It appears that SHA hashes are downloaded from the same resource (merely appending .sha1)

Please check for mirrors being HTTPS only.