As the subject says, i think 'useNoSSLForPackages' is rather badly conceived. Whenever i see an option that has the word "No" or "Don't" in it, alarm bells ring in my head.
This is a recipe for confusion. Can we get future versions of the option renamed to "useSSLForPackages"? (I would make it off by default, too, since many packages are rather large and some of us still pay a lot for bandwidth.)
I suppose i should bugzilla this...