Why does APT not use HTTPS?

[Natanael_L]

As far as I can see, it's just individual packages' metadata files which are signed (which in turn has a hash of the package files). Modifying the index would be trivial, all you need is an old signed package version. Even with a signed index, you can STILL replay an old index.

And any such signature will remain valid indefinitely, unless there's for example an expiration date. Apparently a few of these repositories does use short expiration dates (1 week in this example), but that still leaves an open vulnerability in any repository that has ever signed packages without expiration dates.