Layering HTTPS on top of the existing authentication system adds the obvious benefit of confidential communication, such that an eavesdropper can't see what pac

Layering HTTPS on top of the existing authentication system adds the obvious benefit of confidential communication, such that an eavesdropper can't see what packages you're downloading. There's an argument that you can infer the package from the size of download, but this is defeated by downloading partial regular sized chunks of the file with some overlap to mask the actual size. The only sensible argument against HTTPS seems to be infrastructure cost. This made more sense in the past, but nowadays hardware crypto acceleration (e.g. AES-NI) is commonplace, and certificates can be obtained for free. Ultimately it's up to mirrors to decide if they're willing to provide HTTPS.