rt://130819. The end user may not be aware of the underlying issues, a https default makes sense, forcing those who understand the issue to make the change where appropriate.

Default to the secure option is fair.

Default to the secure option is fair

But the case here is that the "secure option" is being enforced.
If I want to download www.cpan.org/authors/01mailrc.txt.gz, I'm forced to do it securely.
A fresh build of perl (from source) has no capability (AFAICS) to perform such a secure download.
Therefore the cpan utility is initially reliant on some external utility that is capable of a secure download - and there's no guarantee that such an "external utility" exists.
If no such external utility is available to cpan, then cpan is unusable on a fresh build of perl, no matter how you configure it.
That's a rather annoying situation to be in - especially if, as Anonymous Monk asserts elsewhere in this thread, it's a situation created by the cpan.org webserver.

Cheers,
Rob