"How it works" says domain validation using HTTPS

In my opinion, you’re right.