Note that Fedora distributes metalinks to mirrorlists via https, and the main mirror at https://dl.fedoraproject.org/pub/ https://dl.fedoraproject.org/pub/ also

Note that Fedora distributes metalinks to mirrorlists via https, and the main mirror at https://dl.fedoraproject.org/pub/ https://dl.fedoraproject.org/pub/ also uses https. We don't mandate that for our (volunteer!) mirror network, but many mirrors _are_ https. (See https://admin.fedoraproject.org/mirrormanager/mirrors/Fedora/28/x86_64 https://admin.fedoraproject.org/mirrormanager/mirrors/Fedora... for the current list.)