Not necessarily, I think you underestimate the complexity of this attack. Even if you were interested in a few packages, if any additional packages are mixed i

Not necessarily, I think you underestimate the complexity of this attack. Even if you were interested in a few packages, if any additional packages are mixed in or if dependencies are already installed, this problems become a lot harder again. While HTTPS doesn't make such an "attack" impossible, it makes it very hard and compared to HTTP the attacker cannot inject or replace data (replay attacks are possible with APT on plain HTTP)