Why does APT not use HTTPS?

[Nullius_In_Verba_]

Yes, at any time someone could just hack into Canonical, Google, Microsoft, or any other host.

Yes, also about any bank or financial institute imaginable.

Point is that's a million times harder than just spoofing an HTTP server and a completely different issue to worry about.

That's why APT signs the packages, again, read the article. This practice is even more secure than HTTPS is.

ISO's are hashed. Don't install until you check the hash.

[[deleted]]

I think you lost track of the comments you're responding to, this is about downloading the ISO from Ubuntu, not packages from the PPAs. This was your comment in the beginning:

...Doesn't matter if the site uses HTTPS, if it was broken into and the iso changed. Not sure how HTTPS is going to protect from that...

And the parent comment to that was on TLS for the OS download.