apt (dpkg) binaries need to be anyway PGP signed, so HTTPS is just a another layer of security, which is mostly redundnant. Not too long ago, apt in fact predom

apt (dpkg) binaries need to be anyway PGP signed, so HTTPS is just a another layer of security, which is mostly redundnant. Not too long ago, apt in fact predominantly used HTTP. However, then this MITM vulnerability was found that would've been avoided by using HTTPS, and I think they pretty much switched to using HTTPS from then on: https://justi.cz/security/2019/01/22/apt-rce.html https://justi.cz/security/2019/01/22/apt-rce.html