Doesn't APT work over http with GPG signatures, by default? Why are you using an old version of curl to update your debian, instead of pulling a new binary (or

Doesn't APT work over http with GPG signatures, by default? Why are you using an old version of curl to update your debian, instead of pulling a new binary (or source) package?