Actually, given that, it has to be said that the path of least
resistance is to use one of the existing SSL-capable tools (probably
"fetch"), and just leave tnftp as not-https-enabled.
So, FETCH_BASIC would force using plain old tnftp.
A naive solution could just use fetch for everything not tagged with
FETCH_BASIC, but it would make for a more minimal installation if
"tnftp" was used for all but https: URLS, or alternatively, tnftp was
used by default for all packages that don't contain an https: URL in
their master sites list. I suspect the latter is easier to plumb into
the dependency system.