https is useless for package management, given that most people are downloading from mirrors. What you want is a signature over the entire repository, like Deb

https is useless for package management, given that most people are downloading from mirrors. What you want is a signature over the entire repository, like Debian and Ubuntu do (not just signing individual packages, like Fedora does). Once you have that, you don't need HTTPS.