Apparently Windows Update uses TLS without encryption (null cipher) which still provides integrity and authentication: https://twitter.com/swiftonsecurity/statu

Apparently Windows Update uses TLS without encryption (null cipher) which still provides integrity and authentication: https://twitter.com/swiftonsecurity/status/745333018697469953 https://twitter.com/swiftonsecurity/status/74533301869746995.... Debian's signing achieves the same result by signing the package list containing the packages' hashes with a known key.