> providing a huge worldwide mirror network available over SSL is not only a complicated engineering task Nobody said each mirror couldn't have its own certifi

> providing a huge worldwide mirror network available over SSL is not only a complicated engineering task Nobody said each mirror couldn't have its own certificate and its own domain. The host names of these mirrors are usually obtained from a trusted source. HTTPS in addition to GPG signatures does no harm. It also means that one would have to compromise two entities, my distro's GPG key and my mirror's certificate.