You can still pull with the Git protocol. Pulling over SSH is
optional, and likely depends on how paranoid you are about MiTM
attacks ;). Still, if pulling with the Git protocol is good enough
for non-contributors, it's probably good enough for contributors as
well.