Github probably trust their CDN with their TLS key. For Debian, packages are secured by PGP in combination with checksums so it's not relevant for them. The d

Github probably trust their CDN with their TLS key. For Debian, packages are secured by PGP in combination with checksums so it's not relevant for them. The debian repos are often HTTP only.