@yo' curl
ctan.org returns "403 Forbidden" to me, from different locations. I would expect a "301 Moved Permanently" for the redirection to https. Browsers may simply do https anyway as it was cached by the browser and users don't even notice when it, except when they never used https for it or call ctan.org for the first time.