I ran into this same issue as well. It seems https is also supported the link just doesn't use it for some reason. You can right-click "Download dSYM", copy the link, add the "s" to "http", and navigate to that URL.

Our notifications have not been working for any production subscriptions, but they are working for sandbox ones. Do they work for you when making sandbox subscriptions or purchases?

We are also experiencing this issue. Sandbox notifications send correctly, but despite multiple renewals a day we don't get any production notifications. Did you ever get them working?