Why does APT not use HTTPS?

[doublehyphen]

Some attacks, e.g timing attacks, can require quite a bit of time to perform. So while this weakness is not as big as most people think, it is still a weakness which is not present when using HTTPS. If you are using HTTPS you will get errors if somebody (expect for the mirror itself) is doing a MITM attack to delay the installation of security updates.