I didn't downvote this and this is a valid misunderstanding. The whole point of having GPG is that you (as the distributor/debian repo/whatever) have already s

I didn't downvote this and this is a valid misunderstanding. The whole point of having GPG is that you (as the distributor/debian repo/whatever) have already somehow distributed the public key to your clients (customers/debian installations/whatever). Having HTTPS is redundant as it is presumed that initial key distribution was done securely.