An interesting thing is that it should be the other way around. Repository packages usually are signed with GPG. You can even use HTTP - it does not matter. An

An interesting thing is that it should be the other way around. Repository packages usually are signed with GPG. You can even use HTTP - it does not matter. And GPG could be used to sign packages on another machine, may be even on offline machine with HSM. Things like pip or curl rely only on HTTPS. There are many agents between developer who built a deliverable artifact and your machine. There's WWW-server. There's some CDN with HTTPS termination. There's NSA which can issue fake certificate and MITM attack you (mostly imaginably threat for sure, but still). And hacked WWW servers already happened. Transmission website was hacked and their binary was infected. Now I don't claim it to be a big issue. Malevolent developer is much more dangerous and much more likely to happen. But if we want to compare those two methods - I think that repositories with proper signatures are safer.