So they don't consider privacy beyond which host I contact, which is weird, because I'm pretty sure which version of packages I have is relevant to an attacker.

So they don't consider privacy beyond which host I contact, which is weird, because I'm pretty sure which version of packages I have is relevant to an attacker. And in case of a zero-day exploit it would be really handy not having to wait for some global timeout during which I won't see any updates.