There's also a current and ongoing "discussion" (I say pejoratively) regarding the same issue with VideoLAN. They can't (easily) use HTTPS because they don't co

There's also a current and ongoing "discussion" (I say pejoratively) regarding the same issue with VideoLAN. They can't (easily) use HTTPS because they don't control the mirrors. However the package download/update itself is also signed with GPG, thus guaranteeing tamper resistance. https://twitter.com/videolan/status/1086672630994927616 https://twitter.com/videolan/status/1086672630994927616