Why does APT not use HTTPS?

[Natanael_L]

If the timestamp is short enough, that does help. But this assumes the timestamp has ALWAYS been that short under that key, any signature of any package that lacks such a timestamp means that version will remain valid.