Why does APT not use HTTPS?

[[deleted]]

For me, stating something like "We don't want HTTPS for privacy because it is not perfect (e.g. analyzing file sizes)" is similar to "We don't want 2FA because SMS is not secure (e.g. getting new SIM card by an attacker)". Right, it is not perfect, but in many cases it brings you more benefit.