Well, it still involves some kind of public key infrastructure, but encryption could be optional even in https. Linux distros have been hosting their packages o

Well, it still involves some kind of public key infrastructure, but encryption could be optional even in https. Linux distros have been hosting their packages on plain http for two decades, PGP signatures (again, not a great example of "trivial", I admit) were sufficient to ensure integrity.