Package managers don't use https on purpose in order to make it easy to cache a repository. This is alright from a privacy perspective, because you can find ou

Package managers don't use https on purpose in order to make it easy to cache a repository. This is alright from a privacy perspective, because you can find out which packages are downloaded anyway by looking at the download sizes.