They have a network of voluntary mirrors using very different stacks that give them storage and bandwidth for free. Similar to Debian's APT [0]. VideoLAN isn't

They have a network of voluntary mirrors using very different stacks that give them storage and bandwidth for free. Similar to Debian's APT [0]. VideoLAN isn't in a position to enforce it's hosts to serve the files over TLS. However the cryptography of the signature check will be updated in the future. [0] https://whydoesaptnotusehttps.com/ https://whydoesaptnotusehttps.com/