To be fair to the apt developers/maintainers - the security _is_ automatic when using their tool to talk to their repos. It's not their responsibility to autom

To be fair to the apt developers/maintainers - the security _is_ automatic when using their tool to talk to their repos. It's not their responsibility to automate security for people using their repos via different tools. If the solution was just "install certbot on the server and use a free https cert" then perhaps you could make an argument saying maybe they should just do it. But when the problem space includes aggressively using a global (largely volunteer) mirror network and supporting local caching proxies, I can completely understand why they'd say "Nope. Not our problem, not our responsibility to provide a solution. We've got other more productive ways to spend our and our mirror volunteers time and effort".