I've been using http://ftp.debian.org http://ftp.debian.org and http://archive.ubuntu.com http://archive.ubuntu.com for the same purpose. APT mirrors provide GP

I've been using http://ftp.debian.org http://ftp.debian.org and http://archive.ubuntu.com http://archive.ubuntu.com for the same purpose. APT mirrors provide GPG signatures for packages, so they don't usually use HTTPS. There's no guarantee that they won't move over to HTTPS in the future though, so it's nice to know that NeverSSL exists.