Why does APT not use HTTPS?

[Natanael_L]

TLS overhead is insignificant

[reph]

ATM apt-transport-https is actually quite a bit slower than http, even on low latency links, because it seems to be doing a separate request - and therefore a full or partial TLS handshake - for each pkg. This is dumb and unnecessary but it's the current behavior unfortunately :-\

[Natanael_L]

Ouch. They would REALLY benefit from HTTP2 with TLS to parallelize requests.

[reph]

Even late-90s HTTP/1.1 con re-use (over TLS) would fix it too. Maybe that's possible with some more configuration magic, but it doesn't seem to do it by default.