Ah-hah. I discovered that I have to use a proxy, otherwise the setRemoteCredentials function is ignored... Using a proxy and a services- config.xml to set parameters, I recokon I can specify https. Certainly I can specify it as destination:
destination property destination:String [read-write] An HTTPService destination name in the services-config.xml file. When unspecified, Flex uses the DefaultHTTP destination. If you are using the url property, but want requests to reach the proxy over HTTPS, specify DefaultHTTPS. ,,,but I remain unclear whether that means that I am actually communicating across a secured channel... or just accessing a secure destination. Anyway, some light in the murk.

