2
xoops can do SSL connection itself (i think, but have never needed to so not sure)
as for the rest, try wf-downloads. it's pretty secure and allows you to even store files outside of the webroot so that nobody can link to your files either. it also gives the file a unique name on upload, for even more protection.