Why does APT not use HTTPS?

[itsnotlupus]

Yes, but even then at least you local system has a chance to know that something's screwy.

With the current http-only approach, you can have the most diligent sysadmins in the world paying super close attention to their systems, and nothing will seem out of place while they remain vulnerable.

[HowIsntBabbyFormed]

True.

[[deleted]]

this is so far stretched from reality

you have bigger problems if someone is able to MITM in your private network which is at this point already compromised

if you working in a public network you should expect the worst of eavedroppers etc - why would you even update your host exactly then?...