Current download page http://piwik.org/download/ has a link to
is available but just not presented to the users. Just add the "s"... and 301 to https.
There are also other plain HTTP links on https://piwik.org/download/, which can be seen in the page source (open the above HTTPS link and search the source for "http:"), e.g.: - builds.piwik.org (see also https://github.com/piwik/piwik/issues/7520) - developer.piwik.org - forum.piwik.org (the only *.piwik.org domain without HTTPS support; see https://github.com/piwik/piwik/issues/9443) - plugins.piwik.org - etc.
We've made piwik.org SSL by default now with 301 redirects to SSL pages.