That was largely the case until recently, but I don't think it would be difficult now to set up LetsEncrypt and do HTTP-01 challenges. A slightly more complicat

That was largely the case until recently, but I don't think it would be difficult now to set up LetsEncrypt and do HTTP-01 challenges. A slightly more complicated set up, but one entirely within the Debian org's means, would be to use the DNS-01 challenge. But to the article's point, the DNS requests and IPs and file sizes would all be largely transparent, and that's probably enough to figure out what's being downloaded. On the other hand, HTTP/2 could improve throughput and ensure proxies aren't tampering or replaying.