README currently says to get OCaml from source at http://caml.inria.fr/pub/distrib/ocaml-4.02/ocaml-4.02.2.tar.gz which is http, and doesn't have an https equivalent.
The newer instructions from ocaml.org to get the source are here: http://ocaml.org/releases/svn.html
The only https solution is through github... Which is automatically sync'd with the insecure svn repo.
Security people everywhere are sad.