Even if you trust "normal" https certificates, it's still a much more risky proposition. Those certificates only really say that somebody control the domain -

Even if you trust "normal" https certificates, it's still a much more risky proposition. Those certificates only really say that somebody control the domain - not (in general) that he actually owns it or is responsible in any way, and, more critically, don't vet whether somebody is trustworthy or not. You can easily get some other similar-sounding domain as a malicious agent, and validly get an https certificate for that. So even if you trust https works, it's still a tricky proposition - it's not really similar to a distro's package distribution channel.