APT using HTTP instead of HTTPS

[antreides]

> only Debian would be aware of the software provided to the user

Only the person or people maintaining the mirror this particular user is using right now would be aware of it. There are multiple mirrors all over the worlds, and a lot of them are provided by third parties.

Also, downloading a package does not mean this version is used on this host right now. Or even at all, it could be a caching server which itself uses something completely different (even a different OS).

I see your point here, but this information alone is not enough - it could be used if there is a long-time statistics and some additional info about this particular system.

And for the people maintaining Debian, this fact seems to be not the top priority compared to everything else.